Skip to content
THREATWIRE

DeFi Security · Vulnerability class

Oracle and spot-price manipulation

A protocol reads a price from a source that an attacker can move cheaply, or that is simply wrong, and then lends, mints or liquidates against it.

DatabaseIncidentsChainsProtocolsVulnerabilities

The concept

Prices are inputs. If an input can be bought, borrowed for one transaction or computed wrongly, every decision made from it inherits the error. Thin pools, two-source medians and shared conversion steps are the usual weak points.

Defensive lessons

  • Estimate what it costs to move each price and compare it with what that price controls.
  • Require a minimum number of genuinely independent sources and reject answers below it.
  • Cap how far a price may move between updates and pause borrowing when it does.
  • Do not accept thin tokens as collateral.

Stored incidents