Chainlink (or similar) responses are used without checking updatedAt freshness, round completeness, or non-positive answers, so a frozen or faulty feed feeds bad prices into the protocol.
(uint80 rid, int256 p,, uint256 updatedAt, uint80 ansIn) = feed.latestRoundData(); require(p > 0, "bad price"); require(updatedAt != 0 && block.timestamp - updatedAt <= HEARTBEAT, "stale"); require(ansIn >= rid, "stale round"); uint256 price = uint256(p);
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0024 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.