Fallback behavior on oracle failure
BENQI's assessment for RD-F-051 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Core lending markets have NO automated oracle fallback. BenqiChainlinkOracle calls `latestRoundData()` and uses the Chainlink result (or the manual `assetPrices` override if set) without reverting to a secondary oracle on failure. If a feed reverts, the transaction reverts; if a feed returns stale data (within 24hr heartbeat), the stale price is accepted. The manual `assetPrices` mapping is not an automated fallback — it requires admin intervention. Isolated Markets dual oracle (Chaos Labs → Chainlink) provides genuine fallback. Dedaub Ignite audit (M1, resolved) identified the same no-staleness-check pattern in the Ignite contract.
Sources #
- AuditDedaub BENQI Ignite Audit (2023-03-28)Dedaub BENQI Ignite audit M1 — No staleness check on Oracle returned values (resolved in Ignite; analogous pattern in core oracle)retrieved 2026-05-16
- BenqiChainlinkOracle verified source (Snowscan)BenqiChainlinkOracle source at 0x316aE55EC59e0bEb2121C0e41d4BDef8bF66b32B — getUnderlyingPrice() and assetPrices mappingretrieved 2026-05-16
- Profile §7 — BenqiChainlinkOracle single-source per assetrisk-dashboard/.research/protocols/benqi/00-profile.md §7 oracle noteretrieved 2026-05-16
Methodology #
Identify the declared fallback behavior (pause, secondary source, last-known-price, revert) when the primary oracle reverts or reports a stale value.
See the full factor methodology and distribution across all protocols →