# Oracle price source misconfiguration

Wrong feed, pair, rounding, or tuple order makes the price differ from the asset's true value

_Area: DeFi oracles, liquidations and flash loans. Seen in 4 disclosed reports; latest 2026-03-09. Updated 2026-10-24._

## How it works
A protocol assumes the price it reads equals the fair value of the asset it is valuing. That assumption breaks when the feed is wired wrong: the wrong pair, the wrong rounding direction, a single price applied to assets that should be priced separately, or a tuple unpacked in the wrong order. The contract still returns a number, so nothing reverts; the number is just wrong, and every decision built on it (mint, borrow, liquidate, rebalance) is wrong in the same direction.

## Where it shows up
- LP or basket oracles that collapse several assets into one price using min/max of the underlying feeds [E1](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-06.md)
- Reimplemented Uniswap V3 TWAP math, especially signed tick division and rounding [E2](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-18.md)
- Integrations with a lending market whose oracle config (e.g. E-mode single oracle) can differ from your own feeds [E3](https://bugbountylibrary.com/r/sherlock%3A2023-05-Index%3AM-9.md)
- Multi-value returns unpacked positionally into same-typed variables [E4](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-03.md)
- Any place a price is consumed for collateral, borrow, liquidation or rebalance sizing

## How to review
Trace each price from source to use and confirm the invariant: the value used equals the fair value of exactly that asset under the protocol's own definition. For LP/basket oracles, check each reserve is priced by its own feed, not one feed applied to the sum [E1](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-06.md). For TWAP code, compare rounding and sign handling against the reference library [E2](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-18.md). For external-market integrations, confirm your valuation matches the market's oracle configuration, including modes that change it [E3](https://bugbountylibrary.com/r/sherlock%3A2023-05-Index%3AM-9.md). For every destructuring site, match position against the declared return order [E4](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-03.md).

## Variants seen
- Min-of-two applied to summed reserves, systematically undervaluing the LP [E1](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-06.md)
- Negative tick average truncated toward zero instead of rounded down [E2](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-18.md)
- Own feeds diverge from the integrated market's single-oracle E-mode valuation [E3](https://bugbountylibrary.com/r/sherlock%3A2023-05-Index%3AM-9.md)
- Tuple destructuring swapped slow/spot/eons weights, anchoring liquidation to a stale price [E4](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-03.md)

## Impact and severity
Undervalued collateral invites arbitrage against the protocol [E1](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-06.md); skewed TWAPs enable arbitrage or block liquidation [E2](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-18.md); mis-sized rebalances raise liquidation risk [E3](https://bugbountylibrary.com/r/sherlock%3A2023-05-Index%3AM-9.md); insolvent accounts dodge liquidation because the anchor price is stale [E4](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-03.md). Severity rises when the error is systematic (always one direction) and feeds directly into liquidation or solvency checks.

## Why fixes fail
A fix that corrects one call site leaves other consumers of the same misconfigured feed wrong; the invariant must hold at every read, not just the reported one.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-06.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-18.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-05-Index%3AM-9.md
- E4: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-03.md