Fallback behavior on oracle failure
Ethena's assessment for RD-F-051 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Minting oracle fallback: if Pyth or Redstone prices diverge >5% from each other, off-chain order validation rejects the mint. GATEKEEPER_ROLE can additionally halt minting upon anomaly detection. On-chain StablesDeltaLimit (configurable by Dev Multisig, default 0 = disabled) provides a USDe/USDT circuit. No automatic fallback to a backup oracle if both Pyth AND Redstone fail simultaneously — relies on GATEKEEPER_ROLE manual intervention. Chainlink PoR feeds have no on-chain circuit-breaker; attestation-only. The dual Pyth/Redstone validation is effective against single-provider failure but lacks an automated tertiary fallback.
Sources #
- Docshttps://docs.ethena.fi/solution-design/minting-usde/mint-and-redeem-contract-v2retrieved 2026-04-28
- https://docs.ethena.fi/solution-design/minting-usde/user-security-measuresretrieved 2026-04-28
Methodology #
Identify the declared fallback behavior (pause, secondary source, last-known-price, revert) when the primary oracle reverts or reports a stale value.
See the full factor methodology and distribution across all protocols →