Fallback behavior on oracle failure
Liquity V1 + V2 (LUSD / BOLD)'s assessment for RD-F-051 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
v1: 5-state Chainlink+Tellor machine; both-untrusted returns lastGoodPrice (stale price risk during large ETH moves). v2: _shutDownAndSwitchToLastGoodPrice() calls shutdownFromOracleFailure() -- permanent branch halt. LST branches have intermediate fallback (ETH/USD x canonical rate) before full shutdown. The v2 fallback is a graceful terminal halt, not a live secondary oracle. Yellow: fallback exists but v2 secondary is lastGoodPrice at shutdown (stale price used in wind-down), not a live replacement oracle.
Sources #
- GitHubLiquity Bold MainnetPriceFeedBase -- oracle failure shutdown logicliquity/bold MainnetPriceFeedBase.sol -- _shutDownAndSwitchToLastGoodPrice functionretrieved 2026-05-16
- Liquity Bold IBorrowerOperations -- shutdownFromOracleFailure interfaceliquity/bold IBorrowerOperations.sol line 127 -- shutdownFromOracleFailure() external function signatureretrieved 2026-05-16
Methodology #
Identify the declared fallback behavior (pause, secondary source, last-known-price, revert) when the primary oracle reverts or reports a stale value.
See the full factor methodology and distribution across all protocols →