# Oracle will not failover as expected during liquidation

Flatmoney's oracle price-deviation check reverts liquidations when Pyth is stale, so the Chainlink fallback never engages and bad debt accumulates.

- Payout: Contest reward
- Severity: medium
- Program: Flatmoney
- Credited: 0xLogos
- Disclosed: 2023-12-11
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-flatmoney-judging/issues/177
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-flatmoney%3AM-3
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:dos vuln:liquidation vuln:oracle-manipulation

**Target:** LiquidationModule/OracleModule price feed logic
**Root cause:** _getPrice always compares Pyth on-chain price against Chainlink and reverts on PriceMismatch before the fallback branch, so a stale Pyth price blocks liquidation instead of falling back to Chainlink.
**Steps:**
1. Pyth network goes down; on-chain Pyth price becomes stale while Chainlink keeps updating.
2. Liquidator calls `liquidate(tokenId)` (no price update) to avoid Pyth.
3. `_getPrice` computes `diffPercent = |onchainPrice - offchainPrice|*1e18/onchainPrice`.
4. Deviation exceeds `maxDiffPercent`, reverting with `FlatcoinErrors.PriceMismatch` at OracleModule.sol:113.
5. Liquidation cannot proceed; underwater positions and bad debt accumulate.
**How found:** Team stated the no-price-update liquidate path exists so liquidations work when Pyth is down with Chainlink as fallback; reviewer traced _getPrice and noticed the deviation check runs unconditionally before the fallback branch, so stale Pyth reverts before Chainlink is ever used.
**Exploitation:** Not an attacker-driven exploit; a liveness failure triggered by Pyth outage. Liquidators cannot liquidate underwater positions, letting bad debt build up and threatening protocol solvency.
**Insight:** When a protocol advertises an oracle fallback, verify the fallback branch is actually reachable: sanity/deviation checks placed before the source-selection logic can make the 'fallback' path revert on the very condition it was meant to survive.