The Standard

Summary

Call to chainlink.latestRoundData could potentially revert and make it impossible to distribute assets - distributeAssets(). This function is called from the runLiquidation() function. Consequently, a revert in the chainlink can make liquidating the unprofitable vault impossible

Vulnerability Details

Chainlink's multisigs can immediately block access to price feeds at will. Therefore, to prevent denial of service scenarios, it is recommended to query Chainlink price feeds using a defensive approach with Solidity’s try/catch structure. In this way, if the call to the price feed fails, contract should use second(reserve) price feed, for example, it could be uniswap TWAP. It's good practice to have 2 price sources because one might be disabled(revert). If there are 2 sources of price, then the contract will be reliable and it will not be prevented from performing liquidation by reverting the chainlink call.

The same valid issue in other project - https://solodit.xyz/issues/m-09-unhandled-chainlink-revert-would-lock-all-price-oracle-access-code4rena-juicebox-juicebox-v2-contest-git

Impact

Revert in the chainlink can make liquidating the unprofitable vault impossible

Tools Used

Manual review

Recommendations

Wrap call to chainlink in try-catch block.
And implement second price source, which should be used, in catch block - if chainlink price feed is revert.