sherlock-audit / 2023-04-blueberry-judging

8 stars 5 forks source link

helpMePlease - `ChainlinkAdapterOracle.sol` use BTC/USD chainlink oracle to price WBTC which is problematic if WBTC depegs #94

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

helpMePlease

high

ChainlinkAdapterOracle.sol use BTC/USD chainlink oracle to price WBTC which is problematic if WBTC depegs

Summary

Vulnerability Detail

The BTC/USD oracle for chainlink is utilized to price WBTC, which is essentially a bridged asset. In the event of a compromised or failed bridge, WBTC will depeg and no longer be equal to BTC, resulting in significant borrowing against a now worthless asset. As the protocol continues to value it via BTC/USD, it will not only be burdened with bad debt from outstanding loans, but it will also continue to issue bad loans, further increasing the amount of bad debt. See here (docs).

Impact

If the WBTC bridge is compromised and the value of WBTC decreases significantly, the Protocol will have to bear a significant amount of bad debt.

Code Snippet

https://github.com/sherlock-audit/2023-04-blueberry/blob/96eb1829571dc46e1a387985bd56989702c5e1dc/blueberry-core/contracts/oracle/ChainlinkAdapterOracle.sol#L58

Tool used

Manual Review

Recommendation