Algo Ssstablecoinsss

Summary

moccasin.toml's [networks.zksync.contracts] section hardcodes the production price feed addresses that dsc_engine.vy is deployed with. Both eth_usd_price_feed (0xfEefF7c3fB57d18C5C6Cdd71e45D2D0b4F9377bF) and btc_usd_price_feed (0x95Bc57e794aeb02E4a16eff406147f3ce2531F83) have zero deployed bytecode on real zkSync Era mainnet -- verified directly on-chain against two independent RPC endpoints. Any latestRoundData() call the engine makes against either address will fail against an address with no code, making every collateral-value/price-dependent function (deposit_collateral_and_mint_dsc, mint_dsc, liquidate, health_factor, etc.) permanently revert. As configured, the protocol cannot function at all on its actual target chain.

Description

Verified directly against zkSync Era mainnet with cast code <address> --rpc-url https://mainnet.era.zksync.io (cross-checked against a second independent RPC, https://zksync.drpc.org, with identical results):

The weth/wbtc addresses are genuinely correct, live tokens on zkSync Era -- only the two price feed addresses are wrong/non-existent. dsc_engine.vy's oracle_lib._stale_check_latest_round_data does a staticcall to price_price.latestRoundData(); calling a function on an address with no deployed code returns empty returndata, which fails ABI decoding and reverts. Since every single price-dependent path (_get_usd_value, _get_token_amount_from_usd, and therefore mint_dsc, liquidate, health_factor, deposit_collateral_and_mint_dsc) routes through this call, the entire protocol is unusable the moment it's deployed with this configuration -- deposits alone would work, but nothing that needs a price ever will.

Risk

Likelihood:

• Deterministic and unconditional -- this isn't a race condition or edge case, it's the literal address baked into the deployment config for the protocol's actual target network (zkSync Era, per the README's own "Compatibilities: Chains: ZKsync Era" and moccasin.toml's dedicated [networks.zksync] section).

Impact:

• Complete denial of service for the entire protocol on its real target chain -- no one can mint DSC, get liquidated correctly, or read a collateral value, from the moment of deployment. This is the exact class of bug that bricked a real deployment in this same "AI First Flight" series (AirDropper's wrong hardcoded USDC/Merkle-root addresses in Deploy.s.sol).

Proof of Concept

Both configured price feed addresses return empty bytecode on the real, live zkSync Era mainnet -- confirmed against two independent RPC providers to rule out a single-provider indexing issue.

Recommended Mitigation

Replace both price feed addresses with the correct, currently-deployed Chainlink (or equivalent) ETH/USD and BTC/USD price feed contracts on zkSync Era mainnet, and add a deployment-time sanity check (e.g. assert the address has nonzero extcodesize and that a latestRoundData() call succeeds) before considering the engine live.