# PriceFeed is likely to be disabled in times of volatility, causing liquidations and borrows to freeze

Salty.IO's PriceAggregator reverts when three oracles diverge >3%, so during volatility liquidations and borrows freeze exactly when needed.

- Payout: Contest reward
- Severity: medium
- Program: Salty.IO
- Credited: niroh
- Disclosed: 2024-04-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-salty-findings/issues/809
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-08
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos vuln:oracle-manipulation

**Target:** PriceAggregator oracle aggregation (Chainlink, Uniswap 30m TWAP, Salty spot)
**Root cause:** Aggregation averages the two closest feeds and reverts if their difference exceeds maximumPriceFeedPercentDifferenceTimes1000 (3%); a 30-minute TWAP structurally lags spot oracles during sharp moves, so the threshold is breached and the whole feed reverts instead of falling back.
**Steps:**
1. Observe PriceAggregator.sol L142/L183/L195: picks two closest of three feeds, reverts if diff > maxPriceFeedPercentDifferenceTimes1000 (default 3%).
2. Note feed traits: Uniswap 30m TWAP lags; Chainlink updates on >0.5% moves; Salty spot is immediate and on thinner liquidity.
3. Simulate a sharp 5-minute price move: TWAP weights new price ~20%, old ~80%, while Chainlink/Salty report new price.
4. Resulting disparity >3% causes aggregator revert; liquidation and borrow calls that read the feed revert too.
5. DAO can raise max to 7% but each 0.5% step needs >=10-day vote, too slow for volatility.
**How found:** Code reading of the aggregation logic combined with reasoning about the differing update mechanics/latency of the three oracle sources (TWAP vs spot vs Chainlink deviation-triggered updates) and Salty's thinner liquidity.
**Exploitation:** Not an attacker-driven exploit; the flaw is a liveness failure. In volatile markets the feed reverts, blocking liquidations (bad debt accrues) and borrows (users frozen out).
**Insight:** When auditing oracle aggregators, check what happens on disagreement: reverting on divergence converts a price-integrity guard into a liveness DoS during exactly the volatility when liquidations matter. Compare each feed's update cadence (TWAP window vs deviation-triggered vs spot) to find structural divergence.