# Caller-supplied oracle or token trusted for pricing

Does any pricing or payout path trust an oracle, token, or amount the caller controls without validation?

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2023-05-11. Updated 2026-10-25._

## How it works
A contract needs a price or a payout value, and it takes the source of that value from the caller instead of from a trusted, fixed configuration. The assumption that breaks is "the oracle/token/amount I price against is the one the protocol agreed to." When the caller can substitute a worthless token, a malicious oracle, or an inflated balance, the contract computes a value the attacker chose and acts on it (mints shares, releases collateral, pays out LP).

## Where it shows up
- A loan/pool/order constructor takes an `oracle`, `token`, `feeRecipient`, or `hook` parameter from the caller.
- A `_lend`/`stake`/`sell` path uses that parameter later for liquidation, minting, or payout with no equality check against an accepted value.
- A pricing helper branches on a capacity/limit check (`poolCanDeposit`) whose argument is a contract balance rather than the user's actual amount.
- A rewards/staking `sell()` accepts an arbitrary token address and pays out a fixed valuable LP.
- No whitelist or registry of accepted tokens/oracles before value is computed.

## How to review
Trace every value that determines mint, payout, or liquidation back to its source. The invariant: any oracle, token, or pricing input that affects funds must be fixed by the protocol or validated (equality/whitelist) against what the counterparty accepted, before it is used. For capacity-branching helpers, confirm the caller passes the user's actual deposit amount, not the contract's whole balance. Check that the liquidation path and the loan-acceptance path use the same validated oracle.

## Variants seen
- Borrower supplies malicious oracle at loan request; lender never validates, so liquidation never triggers [E2](https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-01.md).
- Staking prices a derivative using full contract balance, flipping a capacity branch to an inflated pool price [E1](https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-02.md).
- `sell()` trusts an attacker-registered fake token and pays out real LP tokens [E3](https://bugbountylibrary.com/r/dhl%3A20230511-sellc.md).

## Impact and severity
Loss of funds and blocked liquidation: ~$95k drained on BSC [E3](https://bugbountylibrary.com/r/dhl%3A20230511-sellc.md); lender unable to seize collateral [E2](https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-01.md); depositors receive fewer shares [E1](https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-02.md). Severity is high where the trusted input directly gates payout or liquidation. Worse when the same unvalidated input is reused across acceptance and liquidation paths [E2](https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-01.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-02.md
- E2: https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-01.md
- E3: https://bugbountylibrary.com/r/dhl%3A20230511-sellc.md