StableOracleWBTC use BTC/USD chainlink oracle to price WBTC which is problematic if WBTC depegs
The StableOracleWBTC contract utilizes a BTC/USD Chainlink oracle to determine the price of WBTC. However, this approach can lead to potential issues if WBTC were to depeg from BTC. In such a scenario, WBTC would no longer maintain an equivalent value to BTC. This can result in significant problems, including borrowing against a devalued asset and the accumulation of bad debt. Given that the protocol continues to value WBTC based on BTC/USD, the issuance of bad loans would persist, exacerbating the overall level of bad debt.\\nImportant to note that this is like a 2 in 1 report as the same idea could work on the StableOracleWBGL contract too.\\nThe vulnerability lies in the reliance on a single BTC/USD Chainlink oracle to obtain the price of WBTC. If the bridge connecting WBTC to BTC becomes compromised and WBTC depegs, WBTC may depeg from BTC. Consequently, WBTC's value would no longer be equivalent to BTC, potentially rendering it worthless (hopefully this never happens). The use of the BTC/USD oracle to price WBTC poses risks to the protocol and its users.\\nThe following code snippet represents the relevant section of the StableOracleWBTC contract responsible for retrieving the price of WBTC using the BTC/USD Chainlink oracle:\\n```\\ncontract StableOracleWBTC is IStableOracle {\\n    AggregatorV3Interface priceFeed;\\n\\n    constructor() {\\n        priceFeed = AggregatorV3Interface(\\n            0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419\\n\\n        );\\n    }\\n\\n    function getPriceUSD() external view override returns (uint256) {\\n        (, int256 price, , , ) = priceFeed.latestRoundData();\\n        // chainlink price data is 8 decimals for WBTC/USD\\n        return uint256(price) * 1e10;\\n    }\\n}\\n```\\n\\nNB: key to note that the above pricefeed is set to the wrong aggregator, the correct one is this: `0x2260FAC5E5542a773Aa44fBCfeDf7C193bc2C599`
To mitigate the vulnerability mentioned above, it is strongly recommended to implement a double oracle setup for WBTC pricing. This setup would involve integrating both the BTC/USD Chainlink oracle and an additional on-chain liquidity-based oracle, such as UniV3 TWAP.\\nThe double oracle setup serves two primary purposes. Firstly, it reduces the risk of price manipulation by relying on the Chainlink oracle, which ensures accurate pricing for WBTC. Secondly, incorporating an on-chain liquidity-based oracle acts as a safeguard against WBTC depegging. By monitoring the price derived from the liquidity-based oracle and comparing it to the Chainlink oracle's price, borrowing activities can be halted if the threshold deviation (e.g., 2% lower) is breached.\\nAdopting a double oracle setup enhances the protocol's stability and minimizes the risks associated with WBTC depegging. It ensures accurate valuation, reduces the accumulation of bad debt, and safeguards the protocol and its users
Should the WBTC bridge become compromised or WBTC depeg from BTC, the protocol would face severe consequences. The protocol would be burdened with a substantial amount of bad debt stemming from outstanding loans secured by WBTC. Additionally, due to the protocol's reliance on the BTC/USD oracle, the issuance of loans against WBTC would persist even if its value has significantly deteriorated. This would lead to an escalation in bad debt, negatively impacting the protocol's financial stability and overall performance.
```\\ncontract StableOracleWBTC is IStableOracle {\\n    AggregatorV3Interface priceFeed;\\n\\n    constructor() {\\n        priceFeed = AggregatorV3Interface(\\n            0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419\\n\\n        );\\n    }\\n\\n    function getPriceUSD() external view override returns (uint256) {\\n        (, int256 price, , , ) = priceFeed.latestRoundData();\\n        // chainlink price data is 8 decimals for WBTC/USD\\n        return uint256(price) * 1e10;\\n    }\\n}\\n```\\n