No checks for negative price in OracleLib.sol
Chainlink data feeds uses int256 instead of uint256 to return prices of assets in case of negative prices , it is a very rare scenario when an asset's price drops below zero (eg. oil price drops below zero ). It is a good practise to be aware of this scenario and have a strategy to face that scenario .
But OracleLib.sol
doesnot have any checks regarding the scenario .
Protocol will fail to function properly if an assets value drops below zero
Manual review
Consider adding this check to sanitize the price returned from oracle
require(answer > 0, "invalid price");
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.