# Oracle fallback to manipulable source

Feed failure or timeout falls back to spot reserves, zero, or a constant instead of reverting

_Area: DeFi oracles, liquidations and flash loans. Seen in 15 disclosed reports; latest 2026-05-18. Updated 2026-10-22._

## How it works
A price path assumes that when a feed fails, times out, or hits a lifecycle boundary, some substitute value is safe. The substitute is either a constant (1.0 at expiry), a sentinel (0 or FIX_MAX), or a manipulable spot source (pool reserves, slot0). Each breaks a different assumption: the constant may not match the real redemption asset, the sentinel may survive downstream math as a plausible price, and the spot source can be skewed by a swap or flash loan. The core failure is that a fallback is treated as a valid price rather than an invalid state that must halt.

## Where it shows up
- Oracle wrappers returning `(0, FIX_MAX)` or `0` on timeout instead of reverting [E2](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-09.md)[E4](https://bugbountylibrary.com/r/c4%3A2023-06-reserve%3AM-06.md)[E7](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-15.md)
- Empty `catch` blocks around oracle calls leaving a sentinel high value [E8](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-06.md)
- Hardcoded rates at expiry/maturity/epoch boundaries [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-10.md)
- Aggregators that skip reverting feeds and continue with the rest [E3](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-4.md)
- Fail-open `staticcall` catch returning spot price [E6](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AH-08.md)
- Pricing helpers branching on capacity using the contract's whole balance [E5](https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-02.md)

## How to review
Trace every path that can produce a price when a feed is unavailable. The invariant: a failed or stale feed must propagate as an invalid price that reverts the consumer, never as a numeric value. Check that sentinels (0, FIX_MAX) cannot pass validity checks after scaling by ratios [E2](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-09.md)[E8](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-06.md). For constants at lifecycle boundaries, confirm the constant equals the live on-chain rate for that exact state [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-10.md). For aggregators, confirm a single feed's revert or zero cannot remove honest sources from the median [E3](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-4.md)[E7](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-15.md). For guards, check comparison direction and that error branches revert, not fall back to spot [E6](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AH-08.md).

## Variants seen
- Constant at expiry mismatched to redemption asset [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-10.md)
- Sentinel FIX_MAX scaled into a valid-looking high price [E2](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-09.md)[E8](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-06.md)
- Reverting feeds dropped from median, leaving manipulated spot [E3](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-4.md)
- Timeout sentinel sizing a sell at zero [E4](https://bugbountylibrary.com/r/c4%3A2023-06-reserve%3AM-06.md)
- Whole-balance capacity check flipping to pool price [E5](https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-02.md)
- Inverted maturity check plus fail-open spot fallback [E6](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AH-08.md)
- Stale heartbeat leaving spot-reserve feed as sole source [E7](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-15.md)

## Why fixes fail
Empty catches and permissive sentinels recur across reports [E2](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-09.md)[E4](https://bugbountylibrary.com/r/c4%3A2023-06-reserve%3AM-06.md)[E8](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-06.md): fixing one consumer leaves others trusting the low or high bound. Tolerating reverts in one feed shifts trust to the remaining feeds [E3](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-4.md)[E7](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-15.md).

## Impact and severity
Over-borrowing against inflated collateral [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-10.md), mispriced auctions and zero-price sell-offs [E4](https://bugbountylibrary.com/r/c4%3A2023-06-reserve%3AM-06.md)[E8](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-06.md), and flash-loan-funded drains [E6](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AH-08.md). Severity rises when the fallback value passes validity checks and when downstream sizing trusts it.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-10.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-09.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-4.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-06-reserve%3AM-06.md
- E5: https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-02.md
- E6: https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AH-08.md
- E7: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-15.md
- E8: https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-06.md