The Standard

Summary

Call to price Oracles could potentially revert and make it impossible to query any prices. Some feeds cannot be changed after they are configured so this would result in a permanent denial of service.

Vulnerability Details

As https://blog.openzeppelin.com/secure-smart-contract-guidelines-the-dangers-of-price-oracles/ mentions, it is possible that Chainlink's "multisigs can immediately block access to price feeds at will". When this occurs, executing LiquidationPool::distributeAssets() will revert, so the protocol won't be able to liquidate positions.

The eurUsd feed is set as immutable, therefore it cannot be updated in case of blocking Oracle.

https://github.com/Mylifechangefast/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/LiquidationPool.sol#L18
https://github.com/Mylifechangefast/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/LiquidationPool.sol#L207

Note that this problem also arises for all the data feeds, especially the one associated with the NATIVE token which cannot be updated.

Impact

If the price Oracle of the NATIVE token or the EUR/USD price feed reverts it will lead to a complete DOS of the protocol.

Tools Used

Manual review

Recommendations

Provide functionality to replace or update oracle feeds after they are configured.