DeFi Oracle Manipulation Path

Instantaneous oracle reads were used at a critical margin-check boundary. A single-block price manipulation surface existed at liquidation thresholds. A time-weighted median and divergence guard were introduced against a secondary source.

Industry

DeFi

Scope

DeFi · Oracle · Application

Timeline

R·Q3 → V·Q3 → R·Q4

Closed

Impact

Manipulation surface

Single-block price move at margin boundary

Liquidation risk

Threshold-triggering trades observable to sophisticated actors

Blast radius

All margin positions gated by the affected feed

Impact vectors

›Price feed manipulation surface
›Liquidation-thresholding risk

Reproduction

Steps below reproduce the finding against a staging replica. Where the reproduction affected a shared component, coordination was arranged before execution.

01Identify positions near the liquidation threshold using public state.
02Model a single-block price move sufficient to cross the threshold.
03Confirm feasibility against liquidity depth on the price source.

Vulnerability

Instantaneous oracle readsolidity

function marginOk(address user) public view returns (bool) {
  uint256 price = oracle.latestAnswer();
  uint256 collateralValue = collateral[user] * price;
  return collateralValue >= liabilities[user] * MARGIN_BPS;
}

Mitigation

Client-side mitigation shipped and validated during the engagement. Reference patch below.

TWAP + divergence guardsolidity

function marginOk(address user) public view returns (bool) {
  uint256 twap = oracle.twap(30 minutes);
  uint256 spot = oracle.latestAnswer();
  require(_within(spot, twap, MAX_DIVERGENCE_BPS), "oracle divergence");
  uint256 collateralValue = collateral[user] * twap;
  return collateralValue >= liabilities[user] * MARGIN_BPS;
}

Retest & Verify

✓Single-block manipulation attempts fail the divergence guard.
✓TWAP window verified against historical adverse candles — no false liquidations.
✓Secondary source cross-check active for all margin reads.

Deliverables

▊Technical Report
▊Oracle model review
▊TWAP hardening patch
▊Retesting report

Sign-off

Handled by

Epulyx

Reviewed by

Nolan

Closed

Case closed after oracle-hardening retest passed.

← All cases Discuss a similar case →