Chainlink returns an int256; a negative value cast straight to uint256 becomes an astronomically large number. Without a require(answer > 0), a negative or zero answer is turned into a near-infinite price.
// answer = -1 (feed glitch) // uint256(-1) = 2**256 - 1 -> collateral value = ~infinity // attacker borrows everything against 1 wei.
(, int256 answer,,,) = feed.latestRoundData(); require(answer > 0, "bad price"); uint256 price = uint256(answer);
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0205 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.