# If a token's oracle goes down or price falls to zero, liquidations will be frozen

Blueberry's liquidate() reverts when a position token's Chainlink oracle is paused or returns zero price, freezing liquidations and risking protocol insolvency.

- Payout: Contest reward
- Severity: medium
- Program: Blueberry
- Credited: 8olidity
- Disclosed: 2023-02-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-blueberry-judging/issues/161
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AM-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:dos vuln:liquidation vuln:oracle-manipulation

**Target:** Lending protocol liquidation / Chainlink oracle adapter
**Root cause:** liquidate() calls isLiquidatable()->getPositionRisk() which queries the oracle for every position token; if latestRoundData reverts, price is stale (PRICE_OUTDATED), or price is zero (PRICE_FAILED), the whole liquidation call reverts.
**Steps:**
1. User holds debt/collateral in token T whose Chainlink feed is paused or returns 0.
2. Liquidator calls `liquidate(user)` on BlueBerryBank.
3. Path: liquidate -> isLiquidatable -> getPositionRisk -> CoreOracle/ChainlinkAdapterOracle price lookup.
4. Oracle reverts (latestRoundData fail) or hits `if (updatedAt < block.timestamp - maxDelayTime) revert PRICE_OUTDATED(_token)` or `if (px == 0) revert PRICE_FAILED(token)`.
5. Liquidation reverts; underwater user cannot be liquidated.
**How found:** Reasoned from historical precedent: Chainlink paused the UST/ETH feed during the UST collapse, so they traced the liquidation call path to confirm any oracle revert propagates and blocks liquidate().
**Exploitation:** No direct attacker profit described; the flaw is that during oracle outage or zero-price events (e.g. UST collapse) all liquidations for holders of the frozen asset revert, leaving bad debt to accumulate and pushing the protocol toward insolvency.
**Insight:** Trace every revert path in a liquidation/health-check function: any external oracle call that can revert (paused feed, stale timestamp, zero price) becomes a DoS on liquidations exactly when solvency matters most. Check whether price reads are wrapped in try/catch or fallback logic.