# Griefable oracle validity thresholds

Liveness or impact thresholds derived per-call or per-block that anyone can trip or split under

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2026-05-18. Updated 2026-10-24._

## How it works
Oracle validity rules are meant to reject stale or manipulated prices. The assumption that breaks is that the rule's trigger is under the protocol's control. When a threshold is derived from recent history, keyed to the current block, or scaled to a single call, an outside actor can move the input that decides whether the check passes. The result is either a false rejection (legitimate prices flagged invalid, blocking users) or a false acceptance (manipulation split into pieces small enough to skip the check).

## Where it shows up
- Liveness/heartbeat values computed from past update gaps rather than a fixed or bounded constant [E1](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-14.md)
- Freshness checks that reject when a timestamp equals `block.timestamp` [E3](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-02.md)
- Manipulation deterrents whose threshold scales with the current call's size, not aggregate exposure [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-27.md)
- Permissionless functions that touch the oracle's timestamp or reserves (`sync()`) [E3](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-02.md)
- Any validity gate whose inputs a non-privileged caller can change cheaply

## How to review
The invariant: a validity check must not be triggerable by an unprivileged actor to reject honest data, and must not be evadable by fragmenting activity. Concretely:
- For derived thresholds, ask what the worst-case value is under legitimate bursty update patterns, and whether it can fall below normal inactivity [E1](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-14.md). Prefer fixed bounds or clamps.
- For freshness checks, reject on `now - timestamp > maxAge`, not on equality with the current block; treat same-block updates as fresh, not invalid [E3](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-02.md).
- For impact/threshold gates, key the threshold off aggregate position or cumulative same-block volume, not the single order's delta [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-27.md).
- Confirm the actor who can flip the check is not the same actor who benefits.

## Variants seen
- Heartbeat derived from second-largest inter-update gap, collapsing under deviation-triggered bursts [E1](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-14.md)
- Per-order impact threshold bypassed by splitting one large order into sub-threshold orders in a block [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-27.md)
- Same-block rejection griefed by front-running `sync()` to set the pair timestamp [E3](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-02.md)

## Impact and severity
Outcomes ranged from prolonged denial of service on a lending market [E1](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-14.md), to defeat of oracle-manipulation protection [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-27.md), to per-block griefing of victim transactions [E3](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-02.md). Severity rises when the trigger is cheap and repeatable each block, and when the bypass silently removes a manipulation safeguard rather than merely pausing service.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-14.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-27.md
- E3: https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-02.md