# Oracle spot-price fallback on feed failure

Pricing helper that swaps to live pool spot when a capacity check or primary feed fails

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2024-02-23. Updated 2026-10-25._

## How it works
A contract needs a price. The primary source (a feed, or a capacity check on a derivative) can fail or return "no". Instead of reverting, the code substitutes a live pool spot price. That assumption — that spot is a safe stand-in — breaks because spot is whatever the next trade makes it, and the caller controls the trade. The fallback turns a failure path into an attacker-priced path.

## Where it shows up
- Pricing helpers with an `if (canDeposit) ... else poolPrice` branch [E2](https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-02.md)
- Callers passing the contract's whole balance rather than the user's amount into that branch, flipping the capacity check [E2](https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-02.md)
- Any `if (!ok)` or capacity gate around an oracle that returns a DEX quote instead of reverting

## How to review
Find every price read and ask: on failure, does control revert or continue with a different source? The invariant: a price used for minting, borrowing or liquidation must come from a source the caller cannot move within the same transaction, and a failed primary must abort, not degrade. Check what amount is passed to capacity-gated helpers — it must be the user's deposit, not the contract balance [E2](https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-02.md).

## Variants seen
- Capacity check on full balance flips pricing to inflated pool spot, shorting depositors [E2](https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-02.md)

## Impact and severity
Under-minted shares to depositors [E2](https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-02.md). Severity rises when the fallback price is same-transaction manipulable and gates minting or borrowing; worse when no deviation or staleness check exists to catch it.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20210125-sushi-badger-digg.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-02.md
- E3: https://bugbountylibrary.com/r/dhl%3A20240223-compounduni.md