Skip to content

Price Feed Missing Sanity Bounds

SAFE-0103 Oracle / Price Checked automatically by the scanner
1

What goes wrong

An oracle answer is used without a require(price > 0) sanity floor or a min/max deviation band. A misconfigured feed, a wrong number of decimals, or a briefly-returned zero can be consumed as a real price and wipe out accounting in one call.

2

The vulnerable pattern

proof of concept — how it is exploited
// feed returns 0 for one block (e.g. during migration)
// collateralValue = amount * 0  =>  every position is instantly liquidatable
// or borrow power = infinite if price sits in a denominator.
3

How to fix it

the pattern that is safe
require(price >= MIN_PRICE && price <= MAX_PRICE, "price out of band");
Bound and zero-check every oracle answer.
4

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0103 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs