An oracle answer is used without a require(price > 0) sanity floor or a min/max deviation band. A misconfigured feed, a wrong number of decimals, or a briefly-returned zero can be consumed as a real price and wipe out accounting in one call.
// feed returns 0 for one block (e.g. during migration) // collateralValue = amount * 0 => every position is instantly liquidatable // or borrow power = infinite if price sits in a denominator.
require(price >= MIN_PRICE && price <= MAX_PRICE, "price out of band");
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0103 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.