Fallback behavior on oracle failure

Pendle Finance's assessment for RD-F-051 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

No documented fallback mechanism in core oracle contracts. getOracleState() returns oldestObservationSatisfied boolean but does not auto-pause or redirect to secondary. Oracle library has no last-known-price fallback. SY wrappers have no fallback if underlying rate getter reverts. Manual pause via dev multisig is the only fallback mechanism. Yellow rather than red because the TWAP design is inherently more manipulation-resistant than spot feeds, and the bounded maturity redemption limits worst-case loss.

Sources #

Etherscan
PendlePYLpOracle Implementation SourcePendlePYLpOracle implementation 0x93e832Ee15a9b00448292373531c16c5398E2dA1retrieved 2026-04-29
GitHub
PendlePYLpOracle Contract SourcePendlePYLpOracle.solretrieved 2026-04-29

Methodology #

Identify the declared fallback behavior (pause, secondary source, last-known-price, revert) when the primary oracle reverts or reports a stale value.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol pendle factor RD-F-051 score yellow collected_at 2026-04-28 21:09:40