Ch_301 - Trigger de-peg event may not be possible at a time when the protocol needs

[sherlock-admin]

Ch_301

medium

Trigger de-peg event may not be possible at a time when the protocol needs

Summary

Based on the current implementation, when the protocol wants to use Chainlink oracle data feed for getting the token's price
In certain exceptional scenarios, oracles may become unavailable or the value of tokens can plummet to zero. In such situations, , no one can trigger the de-pegging event (all calls will revert)

Vulnerability Detail

To trigger de-peg event you need to invoke triggerDepeg() which is get the price from getLatestPrice()
If a token's oracle goes down or the price falls to zero

        if (price <= 0) revert OraclePriceZero();

call will revert

Impact

trigger de-peg event may not be possible at a time when the protocol needs them most. As a result, the users who buy the insurance will receive nothing, when they should.

Code Snippet

Tool used

Manual Review

Recommendation

Make sure that there is a protective measure implemented to prevent this potential situation.

[pauliax]

Escalate for 10 USDC.

This has nothing to do with #435. I think this issue should be invalid because the price and other validations are recommended by Chainlink. Otherwise, this would create a precedent to pick these low-hanging fruits every time: if the protocol has validations, Watsons can suggest dropping them, if it does not validate, then suggest implementing validations (e.g. #154).

[sherlock-admin]

Escalate for 10 USDC.

This has nothing to do with #435. I think this issue should be invalid because the price and other validations are recommended by Chainlink. Otherwise, this would create a precedent to pick these low-hanging fruits every time: if the protocol has validations, Watsons can suggest dropping them, if it does not validate, then suggest implementing validations (e.g. #154).

You've created a valid escalation for 10 USDC!

To remove the escalation from consideration: Delete your comment.

You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.

[hrishibhat]

Escalation accepted

Not a duplicate of #435
Not a valid medium issue on its own as pointed out by the escalation.
Considering this informational.

[sherlock-admin]

Escalation accepted

Not a duplicate of #435
Not a valid medium issue on its own as pointed out by the escalation.
Considering this informational.

This issue's escalations have been accepted!

Contestants' payouts and scores will be updated according to the changes made on this issue.