oracle-manipulation

Oracle Manipulation

Spot Price Manipulation

Spot prices from DEXs (Uniswap V2 reserves, Curve pool balances) can be manipulated within a single transaction via flash loans.

// VULNERABLE: reads instantaneous reserves
function getPrice(address pair) external view returns (uint256) {
    (uint112 reserve0, uint112 reserve1,) = IUniswapV2Pair(pair).getReserves();
    return uint256(reserve1) * 1e18 / uint256(reserve0); // easily manipulated
}

Never use spot prices for:

• Collateral valuation
• Liquidation thresholds
• Governance decisions
• Any value-bearing calculation

TWAP Oracle (Time-Weighted Average Price)

TWAPs average prices over a time window, making manipulation expensive (attacker must sustain the manipulated price across blocks).

import {OracleLibrary} from "@uniswap/v3-periphery/contracts/libraries/OracleLibrary.sol";

function getTWAP(
    address pool,
    address baseToken,
    address quoteToken,
    uint128 baseAmount,
    uint32 twapWindow
) internal view returns (uint256 quoteAmount) {
    if (twapWindow == 0) revert InvalidTwapWindow();

    (int24 arithmeticMeanTick,) = OracleLibrary.consult(pool, twapWindow);

    quoteAmount = OracleLibrary.getQuoteAtTick(
        arithmeticMeanTick,
        baseAmount,
        baseToken,
        quoteToken
    );
}

TWAP Window Selection

Window	Security	Latency	Use Case
1 min	Low	Low	Not recommended
10 min	Medium	Medium	Fast-moving markets with monitoring
30 min	High	High	Lending protocols, collateral valuation
24 hr	Very high	Very high	Governance, long-term averaging

Shorter windows are cheaper to manipulate. For lending protocols, use 30+ minutes.

Multi-Block TWAP Manipulation

Post-merge, a single validator can propose consecutive blocks. With 2+ consecutive slots, a validator can manipulate a short TWAP without competition.

Defense: Use longer TWAP windows (>30 min) or combine TWAP with Chainlink.