Spot-Price Oracle Manipulation in a Lending Pool
Collateral priced from a single AMM's reserves can be inflated inside one transaction with borrowed capital.
The lab pool lends a stablecoin against collateral at 50% LTV. In the vulnerable configuration it prices collateral from the AMM's spot reserves; in the fixed configuration it reads a 30-minute time-weighted average price built from the AMM's cumulative price accumulator.
The AMM starts with 1,000 COL and 100,000 USD (a fair price of 100 USD per COL). The attacker contract receives 400,000 USD of capital as a stand-in for a flash loan, and 100 COL of collateral.
criticalXV-DEMO-06 · Verified by testCollateral value derived from manipulable spot reserves
Collateral value derived from manipulable spot reserves
Description
A large swap skews the pair's reserves and inflates the collateral price. The attacker deposits collateral, borrows against the inflated value, and swaps back — all in one transaction.
Impact
Under-collateralized borrowing drains lendable liquidity.
Recommendation
Use a manipulation-resistant price — a TWAP over a sufficient window or an aggregated feed — with staleness and deviation checks.
mediumXV-DEMO-07 · Identified by reviewNo staleness or deviation bounds on the price input
No staleness or deviation bounds on the price input
Description
The pool accepts whatever price its source returns, with no sanity bounds against a reference value.
Impact
Any oracle failure propagates directly into borrowing limits.
Recommendation
Reject prices that deviate beyond a threshold from a secondary source, and pause borrowing when bounds are hit.
Measured in the lab: valuing every position at the fair price, the single-transaction attack netted the attacker about +114,218 USD against the spot-priced pool. Against the TWAP-priced pool, the identical transaction produced a net loss of about 5,482 USD, because same-block manipulation does not move the time-weighted price.
The TWAP does not remove risk entirely: an attacker able to hold the price away from fair value across the whole window could still move it. XV-DEMO-07 was identified by review and is not exercised by a test.
The lab code and tests for this case study live in labs/web3 of the Xevry website repository.
cd labs/web3npm installnpx hardhat test test/OracleManipulation.test.jsFiles: labs/web3/contracts/Oracle.sol · labs/web3/test/OracleManipulation.test.js
Let's discuss your security needs.
Tell us what you're building. We'll respond with clear questions, an honest view of whether we're the right fit, and a scoped proposal if we are.