# Risk of Incorrect Asset Pricing by StableOracle in Case of Underlying Aggregator Reaching minAnswer

StableOracle DAI/WBTC/WETH oracles trust Chainlink minAnswer, so a crashed asset is priced at the floor, letting attackers mint USSD against inflated collateral.

- Payout: Contest reward
- Severity: medium
- Program: USSD
- Credited: Bauchibred
- Disclosed: 2023-05-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-05-USSD-judging/issues/598
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-05-USSD%3AM-7
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** StableOracleDAI/WBTC/WETH price oracles via ChainlinkFeedRegistry
**Root cause:** Oracles consume aggregator.latestRoundData() without checking the answer against minAnswer/maxAnswer, so a crashed asset is reported at the circuit-breaker floor price.
**Steps:**
1. StableOracleDAI/WBTC/WETH call ChainlinkFeedRegistry.latestRoundData(base, quote)
2. Registry returns aggregator answer; when real price < minAnswer, answer is clamped to minAnswer
3. Oracle returns clamped price to USSD mint/collateral logic
4. Attacker mints USSD against collateral valued at minAnswer (e.g. $1) while real price is $0.10
5. Attacker redeems/borrows against inflated collateral factor for profit
**How found:** Code review of StableOracle contracts against known Chainlink minAnswer/maxAnswer circuit-breaker behavior observed in the LUNA crash.
**Exploitation:** During an asset crash below minAnswer, attacker deposits the crashed token as collateral; oracle reports floor price, so USSD mints ~10x the real value; attacker extracts the difference.
**Escalation:** Secondary oracle (Band) could be DoS'd via relayer flooding to force Chainlink as sole reference, guaranteeing the clamped price is used.
**Insight:** When integrating Chainlink, always compare returned answer to the aggregator's minAnswer/maxAnswer; a clamped floor price during a crash silently inflates collateral value and is exploitable for over-minting.