Summary

Chainlink oracles have a circuit breaker where if the price of an asset has a huge drop in value to ~zero, it will instead of returning 0 return a minPrice. The issue is that the current implementation of the oracleCircuitBreaker does not take this into account, meaning that if this happens, LibOracle will start returning invalid prices for that asset.

Vulnerability Details

When using an asset which is not USD, the LibOracle contract will call the oracleCircuitBreaker function, which is defined as follows:

This function fails to check whether the price of the asset has hit its minPrice, which can result in invalid prices being returned.

Impact

Due to not checking for the minPrice of an oracle, LibOracle will return incorrect prices for assets which have crashed in price below minPrice.

Tools Used

Manual review

Recommendations

Consider adding a check for whether the price returned by the oracle is the minPrice for that asset, and if it is, revert.