# Oracle floor/cap trusted blindly

Chainlink answer used without checking it against the aggregator's minAnswer/maxAnswer band

_Area: DeFi oracles, liquidations and flash loans. Seen in 7 disclosed reports; latest 2025-01-08. Updated 2026-10-23._

## How it works
Chainlink aggregators clamp their reported answer to a configured `minAnswer`/`maxAnswer` band. When the real market price crashes below the floor, the feed keeps returning `minAnswer` — a valid-looking, positive, fresh number that is not the real price. A consumer that checks only positivity, roundId and staleness accepts this clamped value as truth. The broken assumption is "a fresh, positive answer is the real price"; in fact the answer may be a circuit-breaker floor. Any protocol that mints, borrows or liquidates against that number is pricing a crashed asset at its floor.

## Where it shows up
- `latestRoundData()` consumed with checks only for `answer > 0`, `updatedAt` staleness, and `answeredInRound` [E1](https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AM-09.md)[E3](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AM-06.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2023-05-USSD%3AM-7.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AM-16.md)
- A min/max comparison that is inverted or otherwise can never fire, because the aggregator never returns outside the band [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-19.md)
- Aggregator `minAnswer`/`maxAnswer`/`decimals` cached in a constructor instead of read per call [E6](https://bugbountylibrary.com/r/sherlock%3A2022-11-isomorph%3AM-11.md)
- Mint/deposit paths that convert collateral to shares using the raw feed answer [E1](https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AM-09.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2023-05-USSD%3AM-7.md)
- Lending/borrow paths that value collateral from the raw answer [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-19.md)[E3](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AM-06.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AM-16.md)

## How to review
The invariant: every price used for minting, borrowing or liquidation must be proven to lie strictly inside the aggregator's `(minAnswer, maxAnswer)` band, or the call must revert. Check that the consumer reads `minAnswer`/`maxAnswer` from the current aggregator and compares the answer against them with the correct direction — reject when the answer equals or sits at the floor/ceiling, not only when it is outside. Confirm the bounds are fetched per call (or via the proxy), not cached. A median across several feeds does not help if two sources converge on the same clamped floor [E5](https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AM-16.md).

## Variants seen
- No bounds check at all; staleness and positivity only [E1](https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AM-09.md)[E3](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AM-06.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2023-05-USSD%3AM-7.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AM-16.md)
- Bounds check present but inverted, so the floor passes as valid [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-19.md)
- Bounds cached at construction and stale after the proxy swaps the aggregator [E6](https://bugbountylibrary.com/r/sherlock%3A2022-11-isomorph%3AM-11.md)

## Why fixes fail
Adding a `_answer > _max || _answer < _min` guard looks like a fix but is dead code, since the aggregator never returns outside the band [E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-19.md). Caching the band at deploy time also fails once `confirmAggregator` swaps the underlying feed [E6](https://bugbountylibrary.com/r/sherlock%3A2022-11-isomorph%3AM-11.md).

## Impact and severity
Over-minting or over-borrowing against inflated collateral during a crash, and mispriced liquidations [E1](https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AM-09.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-19.md)[E3](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AM-06.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2023-05-USSD%3AM-7.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AM-16.md). Severity is high where the floor is reachable and the mint/borrow path is open; worse when the clamped price is also used for liquidation thresholds, and when multiple feeds share the same floor.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AM-09.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-19.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AM-06.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2023-05-USSD%3AM-7.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AM-16.md
- E6: https://bugbountylibrary.com/r/sherlock%3A2022-11-isomorph%3AM-11.md