Fallback behavior on oracle failure
M^0's assessment for RD-F-051 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No external oracle in core $M minting path so classical oracle-fallback question does not apply to primary rate mechanism. If MinterRateModel reverts, MinterGateway's staticcall-based _rate() causes calling functions to revert — no use-last-known-rate fallback. For off-chain collateral: Validator attestation stoppage halts new minting but existing $M remains valid. TTG governance can replace a broken rate model but 15-day epoch cycle creates a bounded replacement delay.
Sources #
- GitHubMinterGateway.sol sourcem0-foundation/protocol main/src/MinterGateway.sol — IRateModel.rate.selector staticcall pattern with no fallbackretrieved 2026-05-16
Methodology #
Identify the declared fallback behavior (pause, secondary source, last-known-price, revert) when the primary oracle reverts or reports a stale value.
See the full factor methodology and distribution across all protocols →