# Oracle depeg and conversion bridge gaps

Wrapped assets priced by underlying feed, or converters assuming a pair that may not exist

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2024-04-19. Updated 2026-11-06._

## How it works
Two assumptions break. First, a protocol prices a wrapped or pegged asset (WBTC, DIGG) as if it always equals its underlying, so when the wrapper depegs the price path silently diverges from reality. Second, a reward converter assumes a bridge/pair is configured; if it is missing, conversions fail and tokens pile up in the contract, where anyone can create the missing pair cheaply and trade against the protocol's forced conversion.

## Where it shows up
- Oracle code that maps a wrapped asset to the underlying's feed (e.g. WBTC priced by BTC/USD) with no WBTC/BTC ratio applied [E3](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-30.md)
- Converter/`convert()` logic with hardcoded or default bridge paths [E1](https://bugbountylibrary.com/r/dhl%3A20210125-sushi-badger-digg.md)
- Accumulating balances of a token in a converter contract (failed conversions leaving residue) [E1](https://bugbountylibrary.com/r/dhl%3A20210125-sushi-badger-digg.md)
- Stale or bad price feeders used for lending markets [E2](https://bugbountylibrary.com/r/dhl%3A20240223-compounduni.md)

## How to review
- For every wrapped/pegged asset, confirm the feed tracks the wrapper: WBTC/BTC × BTC/USD, not BTC/USD alone. Check the actual feed addresses on the target chain, not just the code's intent [E3](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-30.md).
- For converters, verify the assumed pair exists and has real liquidity; if a bridge can be missing, check what happens to accumulated tokens and who can create the pair [E1](https://bugbountylibrary.com/r/dhl%3A20210125-sushi-badger-digg.md).
- For lending oracles, compare the feeder's price against independent market prices and check update freshness [E2](https://bugbountylibrary.com/r/dhl%3A20240223-compounduni.md).
- Invariant: the price used equals the market price of the exact asset being borrowed or swapped, including any depeg, and every conversion path resolves to a liquid pair.

## How finders spotted it
- Noticed `convert()` calls for DIGG failing because no DIGG/WETH bridge existed, so DIGG accumulated; realized an attacker could create that pair cheaply and sandwich the eventual conversion [E1](https://bugbountylibrary.com/r/dhl%3A20210125-sushi-badger-digg.md).
- Likely monitored the price feeder for deviations from market prices, spotting an undervalued asset to borrow [E2](https://bugbountylibrary.com/r/dhl%3A20240223-compounduni.md).
- Read `CoreChainlinkFeed.sol` and tests, saw only BTC/USD used; cross-checked Chainlink's feed list to confirm no WBTC/USD feed on mainnet, and cited the historical WBTC depeg to 0.98 during the LUNA crash [E3](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-30.md).

## Variants seen
- Missing conversion bridge causing token accumulation and sandwichable forced conversion [E1](https://bugbountylibrary.com/r/dhl%3A20210125-sushi-badger-digg.md)
- Stale or bad price feeder in a lending market [E2](https://bugbountylibrary.com/r/dhl%3A20240223-compounduni.md)
- Wrapper priced by underlying feed, ignoring depeg [E3](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-30.md)

## Impact and severity
E1 drained 81 ETH via sandwich on an illiquid attacker-created pair [E1](https://bugbountylibrary.com/r/dhl%3A20210125-sushi-badger-digg.md). E2 yielded ~$439k from borrowing mispriced UNI and swapping [E2](https://bugbountylibrary.com/r/dhl%3A20240223-compounduni.md). E3 lowers the oracles needing manipulation from two to one, making a single flash-loan swap feasible during a depeg [E3](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-30.md). Severity rises with liquidity at stake and with a depeg precondition that shrinks the attack surface.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20210125-sushi-badger-digg.md
- E2: https://bugbountylibrary.com/r/dhl%3A20240223-compounduni.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-30.md