# Chainlink price feed uses BTC, not WBTC. In case of depegging, oracles will become easier to manipulate

Salty.IO's Chainlink feed prices WBTC using BTC/USD, so a WBTC depeg lets an attacker skew the Salty pool spot price and manipulate the triple-oracle aggregate.

- Payout: Contest reward
- Severity: medium
- Program: Salty.IO
- Credited: thekmj
- Disclosed: 2024-04-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-salty-findings/issues/60
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-30
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:flash-loan vuln:oracle-manipulation

**Target:** Chainlink price feed / PriceAggregator oracle
**Root cause:** The WBTC price is sourced from the BTC/USD Chainlink feed rather than a WBTC-specific feed (WBTC/BTC × BTC/USD), so the oracle ignores WBTC's actual peg deviation.
**Steps:**
1. Observe CoreChainlinkFeed.sol uses BTC/USD feed for WBTC price.
2. Note no WBTC/USD feed exists on Ethereum mainnet; WBTC/BTC feed exists but is unused.
3. During a WBTC depeg, Chainlink returns BTC price while true WBTC value is lower.
4. Flash loan large WBTC, swap in Salty WBTC pool to skew spot price toward the wrong Chainlink price.
5. Aggregator picks the two closest of three feeds, now returning BTC/USD instead of WBTC/USD.
6. Liquidate positions not actually underwater and profit; repay flash loan.
**How found:** Code reading of CoreChainlinkFeed.sol and test cases revealed only the BTC/USD feed is used; cross-checked Chainlink's feed list to confirm no WBTC/USD feed exists on mainnet, and cited historical WBTC depeg to 0.98 during LUNA crash.
**Exploitation:** Attacker flash-loans WBTC, dumps it into the Salty WBTC pool to move the spot price toward the already-deviated Chainlink BTC/USD price, so the PriceAggregator's two-closest selection returns the wrong price; then liquidates healthy positions for profit and repays the loan.
**Escalation:** Depeg precondition lowers the number of oracles needing manipulation from two to one, making the attack feasible with a single flash-loan swap.
**Insight:** When a protocol prices a wrapped/pegged asset, verify the oracle feed actually tracks the wrapper (WBTC/BTC × BTC/USD) rather than the underlying; a single-feed shortcut silently drops depeg risk and weakens multi-oracle aggregation to a one-oracle manipulation.