oracle-manipulation

Oracle Manipulation Playbook

DeFi protocols that read a price from an on-chain source are vulnerable when the source can be moved within a single transaction or block. Classic vectors:

1. Spot-price AMM oracle — reserve1 / reserve0 of a Uniswap V2 pool. Anyone with enough capital (or a flash loan) can push the price for one block.
2. Manipulable TWAP — short window TWAP, or TWAP over a low-liquidity pool.
3. Single Chainlink feed without staleness check — feed returns 0 / stale → uses 0 in math.
4. Custom oracle reading from manipulable storage — e.g., a "fair-price" oracle that reads totalSupply() of an LP token alongside reserves.
5. L2 sequencer offline — L2 oracles need a "is sequencer up?" check or attacker can exploit when sequencer downs and feeds freeze.

Audit steps

1. Locate price-reading code

# Common patterns
grep -rn 'getReserves\|getAmountsOut\|getPriceFromSqrtPriceX96\|latestAnswer\|latestRoundData' src/

# Custom oracle reads
grep -rn 'IPriceOracle\|getPrice\|consult' src/

2. Trace each price use

For each call:

• Is the price read from a Uniswap V2 / Sushi / Camelot pool's reserves? → spot price = manipulable
• Is the price read from a Uniswap V3 pool's slot0.sqrtPriceX96? → manipulable
• Is it a Uniswap V3 TWAP via OracleLibrary.consult? → check the secondsAgo window (>= 1800s = 30 min is the safe minimum)
• Is it a Chainlink latestRoundData() call? → check: is updatedAt validated? Is answeredInRound >= roundId? Is answer > 0? Are L2 sequencer feeds checked?

3. Validate staleness handling

// MISSING — vulnerable
(, int256 price, , , ) = priceFeed.latestRoundData();

// GOOD — explicit staleness + sequencer
(uint80 roundId, int256 price, , uint256 updatedAt, uint80 answeredInRound) = priceFeed.latestRoundData();
require(price > 0, "ORACLE_NEGATIVE");
require(updatedAt > block.timestamp - MAX_DELAY, "ORACLE_STALE");
require(answeredInRound >= roundId, "ORACLE_OLD_ROUND");
// On L2: also check sequencer uptime feed (L2 SequencerUptimeFeed)