Article Details

Price oracle manipulation vulnerability in smart contracts

To build a competitive DeFi project developers need to add interactions with external price data sources — price oracles — for their project. However, recklessness in orchestration architecture development of the oracle interaction processes can lead to Price oracle manipulation vulnerability.

What is a price oracle

Smart contracts are self-executing programs that run without intermediaries, however, smart contracts need external data sources to process their operations on. Oracles are mechanisms that provide external data feeds, allowing smart contracts to make informed decisions.

There are two main types of oracles:

1. Centralized oracles that rely on a single trusted source, like an API from a company. They’re efficient but create a single point of failure.
2. Decentralized oracles that aggregate data from multiple sources, such as DEXs or networks of nodes, to reduce manipulation risks.

Price oracles provide data for most important DeFi project operations like:

• Determining collateral values in lending protocols.
• Executing trades based on market rates.
• Triggering liquidations when loans LTV rate falls over minimal value.

How does price oracle manipulation attack work?

The very fact of DeFi project dependence on Price oracles provides an opportunity for Price oracle manipulation threat. If an attacker could exploit this vuln and influence the data provided by the price oracle, the whole DeFi project logic could be misleaded. Price oracle manipulation vulnerability is ranked highly in security audits because it’s relatively straightforward to execute in under-secured systems.

Price oracle manipulation exploit breakdown

Price oracle manipulation attack is often done by exploiting weaknesses in how the oracle sources its data and how cheap it is to manipulate it.

Below is a simplified scenario of a typical attack:

1. Find a weak oracle. For example, spot prices from low-liquidity DEX is a pretty weak data source that can be easily and cheaply manipulated by large trades.
2. Execute a flash loan. An attacker instantly borrows massive amounts of assets without any collateral using flash loans.
3. Manipulate the price and fool the oracle: Attacker buys or sells desired asset using borrowed funds, which leads to temporary inflation or deflation of the asset’s price.
4. Exploit the contract: With the manipulated price, attackers can over-borrow, under-collateralize the loan on the attacked DeFi platform.
5. Repay and profit: Attacker repays the flash loan from step 2, and keeps an extra amount of the borrowed funds at step 5 as their profit.

Price oracle manipulation attack consequences

Damage of oracle price manipulation can be severe, and include:

• Financial: protocols lose funds, users get liquidated unfairly.
• Reputational: Loss of reputation of DeFi project and its founders and team
• If a DeFi system has dependent projects, one exploit could produce a cascade effect that can affect multiple platforms.

Mitigation strategies

Preventing oracle manipulation requires proactive design.

Some of the battle-tested strategies include:

• Decentralized oracle feed, Aggregated Oracles like Chainlink or Band Protocol
• TWAP / VWAP — Time / volume-weighted averages
• Deviation Checks to reject prices that deviate too far
• Circuit Breakers that pause operations in case suspicious activity
• Liquidity requirements to ensure oracle sources have enough liquidity to make manipulation expensive.
• Regular monitoring, internal security checks and external audits.

Conclusion

Price oracle manipulation threat remains one of the top threats in smart contract development, however it can be mitigated with prioritizing oracle security, data flow decentralization and resilient DeFi project architecture design.

About SmartState

Launched in 2019 and incorporated in Dubai, SmartState is an independent Web3 security company providing top-notch external security audits and enterprise level blockchain security services.

We’ve built a professional team of skilled white-hat hackers, cyber security experts, analysts and developers. The SmartState team have extensive experience in ethical hacking and cyber security, blockchain & Web3 development, financial and economic sectors.

We’ve conducted 1000+ security audits so far. None of code audited by SmartState had been hacked. Blockchains like TON, large projects like EYWA, 1inch and CrossCurve & exchanges such as Binance and KuCoin rely on our experience.

🚀 Concerned about your project & assets security? Book free security consultation! Let’s get in touch: info@smartstate.tech

Stay tuned for more updates from SmartState and follow us on social media to learn about our latest auditing services and success stories:

• Website
• X (formerly Twitter)
• LinkedIn
• Telegram
• Instagram

Disclaimer

Always DYOR. This article is for informational purposes only, does not constitute legal, financial, investment advice and / or professional advice, and we are not responsible for any decisions based on our analysis or recommendations. Always consult with a qualified security expert and conduct thorough testing before deploying smart contracts.

Price oracle manipulation vulnerability in smart contracts was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.