# Sense Finance Access Control Issue Bugfix Review

Missing onlyVault check on Sense Space AMM's onSwap() let anyone write arbitrary oracle prices, enabling collateral theft from Rari Fuse pools.

- Payout: $50,000
- Severity: critical
- Program: Sense Finance
- Credited: Reptile71590
- Disclosed: 2022-06-23
- Write-up quality: 6/10
- Original: https://immunefi.com/blog/bug-fix-reviews/sense-finance-access-control-issue-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sense-finance-access-control-issue-bugfix-review
- Tags: domain:web3 impact:funds-loss impact:integrity kind:bounty platform:blog platform:immunefi sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:oracle-manipulation

**Target:** Sense Space AMM pool contract (Balancer V2 onSwap callback)
**Root cause:** The onSwap() function on the Space AMM pool lacked the onlyVault() modifier present on onJoin()/onExit(), so it accepted oracle-updating calls from any address, not just the Balancer vault.
**Steps:**
1. Identify Sense Space AMM pool contract built on Balancer V2 with onSwap() callback that writes oracle price/reserve/timestamp state.
2. Note onJoin() and onExit() carry onlyVault() but onSwap() does not.
3. Call onSwap() directly from an attacker EOA with crafted price/reserve request data.
4. Oracle state is overwritten with attacker-controlled price and timestamp (arbitrarily far past/future).
5. Rari Fuse pools reading the Space AMM oracle now see the manipulated price.
**How found:** Whitehat compared access control across the pool's Balancer callbacks and noticed onlyVault() guarded onJoin()/onExit() but was absent on onSwap(), which also mutates oracle state.
**Exploitation:** Attacker directly invokes onSwap() with attacker-supplied reserves/price, poisoning the Space AMM oracle. Rari Fuse pools relying on that oracle could then be exploited to take bad loans against inflated collateral or trigger liquidations, stealing borrowable collateral and borrowed assets. Pools were paused on disclosure so no funds were lost.
**Escalation:** Oracle manipulation chained into Rari Fuse lending markets to convert a state-write bug into collateral theft/liquidation.
**Insight:** When auditing Balancer-style pools, enumerate every vault callback (onSwap/onJoin/onExit) and diff their modifiers; any callback that writes oracle or reserve state without onlyVault is directly callable and poisons downstream oracle consumers.