# During oracle provider switch, if previous provider feed stops working completely, oracle and market will be stuck with user funds locked in the contract

Perennial's oracle switchover waits for the old Pyth feed to commit a final price; if that feed dies, the oracle never advances and user funds lock.

- Payout: Contest reward
- Severity: medium
- Program: Perennial
- Credited: panprog
- Disclosed: 2023-09-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-09-perennial-judging/issues/10
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-09-perennial%3AM-1
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:dos vuln:oracle-manipulation

**Target:** Oracle.sol provider-switch logic in perennial-oracle
**Root cause:** Oracle._latestStale returns false while the previous provider's latest timestamp cannot advance, so the switch to the new provider never completes and latest() stays frozen.
**Steps:**
1. Deploy/observe market with oracle provider A (Pyth) active.
2. Governance updates oracle to provider B.
3. Provider A's off-chain feed stops permanently before a final commit for the last requested version.
4. No valid signed price exists for any timestamp after the last request, so A can never be finalized.
5. Oracle._latestStale (line 128) keeps returning false; new provider B is ignored.
6. All market requests revert; withdrawals blocked, funds stuck.
**How found:** Follow-up on prior issue 46 after its fix; reviewer reasoned that the sponsor's assumption (old feed still available to post a non-requested version) fails if the feed dies entirely, leaving no price/signature to commit.
**Insight:** When auditing provider-migration logic, test the failure mode where the deprecated dependency is fully unavailable, not merely stale; a grace period that depends on the old source producing data is a liveness trap.