# Uninitialized oracle observation slots trusted

Oracle reads caller-seeded or same-block observation slots without init/time-weight checks

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2026-09-05. Updated 2026-10-24._

## How it works
A price oracle assumes the observation data it reads is real, initialized, and time-weighted. That assumption breaks when the oracle accepts a caller-supplied index/seed into a ring buffer whose slots may never have been written, or averages fills from the current block only. Uninitialized slots carry sentinel values (timestamp 1, zeroed cumulatives); same-block fills carry no time weight. Either way the oracle returns a price the attacker chose, and downstream collateral/liquidation math trusts it.

## Where it shows up
- Forked Uniswap V3 `Oracle.observe`/`observeSingle` where the upstream `initialized` check on the observation slot is missing.
- Caller-controlled `seed`/index hints passed into circular-buffer interpolation.
- Price functions averaging `amount/futureValue` over fills in the current block with no time-weighting.
- Reliability gates that flip true on volume alone (`isReliableBlock`), clearable by self-trades.
- Privileged order-matching roles that pick counterparties or nudge a TWAP within a spread band.

## How to review
Trace every value the oracle reads back to who can write it and when. The invariant: any observation used as a bound must be initialized (timestamp > 1, non-zero cumulatives) and must predate the current block by the intended window. Check that index/seed inputs are validated against written slots, not just array bounds. For fill-based prices, confirm time-weighting or a multi-block window, and that reliability cannot be satisfied by one actor supplying both sides. For privileged matchers, confirm they cannot self-match user flow or move the TWAP within allowed bounds.

## Variants seen
- Same-block self-trade inflating collateral price via volume-gated average [E1](https://bugbountylibrary.com/r/dhl%3A20260905-securedfi.md).
- Caller-seeded index reading uninitialized Uniswap V3 observation slots, corrupting TWAP/IV [E2](https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AH-2.md).
- Privileged validator self-matching liquidations and skewing markPriceTwap within spread limits [E3](https://bugbountylibrary.com/r/sherlock%3A2023-04-hubble-exchange%3AH-3.md).

## Impact and severity
Led to collateral drain (~0.9 WBTC) [E1](https://bugbountylibrary.com/r/dhl%3A20260905-securedfi.md), bad-debt and liquidation manipulation [E2](https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AH-2.md), and unfair liquidation/funding extraction [E3](https://bugbountylibrary.com/r/sherlock%3A2023-04-hubble-exchange%3AH-3.md). Severity is high: the oracle feeds solvency math directly. Worse when reliability gates are cheap to clear, when the privileged role has no slashing, or when the manipulated price is consumed by both collateral valuation and liquidation thresholds.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260905-securedfi.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AH-2.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-04-hubble-exchange%3AH-3.md