This repository has been archived by the owner on Nov 26, 2023. It is now read-only.
T1MOH - StableOracleWBTC use BTC/USD chainlink oracle to price WBTC which is problematic if WBTC depegs #202
Labels
Duplicate
A valid issue that is a duplicate of an issue with `Has Duplicates` label
Escalation Resolved
This issue's escalations have been approved/rejected
Medium
A valid Medium severity issue
Reward
A payout will be made for this issue
Comments
github-actions
bot
added
Medium
github-actions
bot
added
High
|
Escalate for 10 USDC Not a duplicate of #817 |
You've created a valid escalation for 10 USDC! To remove the escalation from consideration: Delete your comment. You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final. |
|
See comments in #675 |
|
Result: |
|
Escalations have been resolved successfully! Escalation status:
|
hrishibhat
added
Medium
sherlock-admin
added
Escalation Resolved
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
T1MOH
medium
StableOracleWBTC use BTC/USD chainlink oracle to price WBTC which is problematic if WBTC depegs
Summary
The chainlink BTC/USD oracle is meant to be used to price WBTC (but it is blocked by another issue: wrong address of btc/usd priceFeed now is used). WBTC is basically a bridged asset and if the bridge is compromised/fails then WBTC will depeg and will no longer be equivalent to BTC. This will lead to large amounts of borrowing against an asset that is now effectively worthless. Since the protocol still values it via BTC/USD the protocol will not only be stuck with the bad debt caused by the currently outstanding loans but they will also continue to give out bad loans and increase the amount of bad debt further
Vulnerability Detail
Impact
Protocol will take on a large amount of bad debt should WBTC bridge become compromised and WBTC depegs
Code Snippet
https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWBTC.sol#L8-L27
Tool used
Manual Review
Recommendation
I would recommend using a double oracle setup. Use both the Chainlink and another on-chain liquidity base oracle (i.e. UniV3 TWAP). If the price of the on-chain liquidity oracle drops below a certain threshold of the Chainlink oracles (i.e. 2% lower), any borrowing should be immediately halted. The chainlink oracle will prevent price manipulation and the liquidity oracle will safeguard against the asset depegging.
Duplicate of #310
The text was updated successfully, but these errors were encountered: