Chainlink aggregator min/max bound misconfig
Superstate's assessment for RD-F-060 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Chainlink EACAggregatorProxy feeds (0x289B5036..., 0xAfFd8F55...) are Superstate-custom NAV aggregators, not standard Chainlink asset price feeds. Standard minAnswer/maxAnswer circuit-breaker bounds may be set to broad defaults. 0xMacro superstate-1 M-2 found incorrect price validation (6-decimal assumption vs 8-decimal Chainlink format) — fixed. Post-fix bounds configuration not directly verifiable without RPC access. Yellow: prior misconfig found and fixed; post-fix bound values not confirmed.
Sources #
- Audit0xMacro superstate-1 Audit Report0xMacro superstate-1 M-2: Incorrect USTB Price Feed Validation — validation assumed 6 decimal precision but Chainlink uses 8 decimals; fixed via commit 3710c88retrieved 2026-05-16
- USTB Chainlink EACAggregatorProxy — EtherscanChainlink USTB EACAggregatorProxy 0x289B5036... — EACAggregatorProxy pattern confirmed; custom NAV aggregator, not standard Chainlink asset feedretrieved 2026-05-16
Methodology #
Determine whether the Chainlink aggregator's `minAnswer` and `maxAnswer` circuit-breaker bounds are misconfigured (too wide or too narrow) for the asset class.
See the full factor methodology and distribution across all protocols →