The Standard

Summary

In some extreme cases, oracles can be taken offline or token prices can fall to zero. In these cases, liquidations will be frozen (all calls will revert) for any debt holders holding this token, even though they may be some of the most important times to allow liquidations to retain the solvency of the protocol.

Vulnerability Details

Chainlink has taken oracles offline in extreme cases. For example, during the UST collapse, Chainlink paused the UST/ETH price oracle, to ensure that it wasn't providing inaccurate data to protocols.

In such a situation (or one in which the token's value falls to zero), all liquidations for users holding the frozen asset would revert. This is because any call to LiquidationPoolManager::runLiquidation calls LiquidationPool::distributeAssets, which calls the oracle to get the values of eurUsd and asset.token.clAddr (the token's oracle).

Depending on the specifics, one of the following checks would cause the revert:

• the call to Chainlink.AggregatorV3Interface(eurUsd).latestRoundData() would fail

• the call to Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData() would fail

If the oracle price lookup reverts, liquidations will be frozen, and the user will be immune to liquidations. Although there are ways this could be manually fixed with fake oracles, by definition this happening would represent a cataclysmic time where liquidations need to be happening promptly to avoid the protocol falling into insolvency.

Impact

Liquidations may not be possible at a time when the protocol needs them most. As a result, the value of user's asset may fall below their debts, turning off any liquidation incentive and pushing the protocol into insolvency.

Code Snippet

https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/LiquidationPool.sol#L207
https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/LiquidationPool.sol#L218

Tools Used

Manual Review
https://medium.com/cyfrin/chainlink-oracle-defi-attacks-93b6cb6541bf#e100

Recommendations

Ensure there is a safeguard in place to protect against this possibility.