Chainlink oracle will return the wrong price if the aggregator hits minAnswer
Chainlink aggregators have a built in circuit breaker if the price of an asset goes outside of a predetermined price band.
The result is that if an asset experiences a huge drop in value (i.e. LUNA crash) the price of the oracle will continue to return the minPrice instead of the actual price of the asset.
This would allow user to continue borrowing with the asset but at the wrong price. This is exactly what happened to Venus on BSC when LUNA imploded
In OracleLib.sol, staleCheckLatestRoundData() function,
Here, the function does not check the price acceptable range.
Manual Review
Consider using the following checks.
For example:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.