Fallback behavior on oracle failure
Sanctum's assessment for RD-F-051 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No external oracle to fail in the traditional sense. For LST pricing: if any individual LST's stake pool state is unreadable (e.g., program halted or account corrupted), the Router/Infinity cannot compute that LST's value and the relevant swap route becomes unavailable. There is no fallback pricing source — the protocol does not fall back to a secondary oracle or last-known price. The failure mode is a revert/unavailability for that specific LST route rather than a wrong-price execution. Structurally acceptable for a single-LST failure but the Infinity pool's multi-LST basket concentration amplifies the aggregate exposure.
Sources #
- Docs00-profile.md §7Profile §7: pricing from on-chain state; no fallback documented; architecture analysis of SOL Value Calculator Programs (per-LST-type, not a fallback chain)retrieved 2026-05-04
- Sanctum S program repositoryigneous-labs/S README: SOL Value Calculator Programs are per-LST-type; no secondary/fallback oracle chain listedretrieved 2026-05-04
Methodology #
Identify the declared fallback behavior (pause, secondary source, last-known-price, revert) when the primary oracle reverts or reports a stale value.
See the full factor methodology and distribution across all protocols →