# Price feed can be manipulated

Marginswap's price feed simulates a Uniswap spot trade on manipulable reserves, letting flash loans skew prices and break borrowing and liquidations.

- Payout: Audit contest
- Severity: high
- Program: Marginswap
- Disclosed: 2021-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-04-marginswap-findings/issues/21
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-marginswap%3AH-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:flash-loan vuln:oracle-manipulation

**Target:** PriceAware.getCurrentPriceInPeg price oracle
**Root cause:** Price is derived by simulating a Uniswap-like trade against current pair reserves, which are spot and flash-loan manipulable, instead of a time-weighted average.
**Steps:**
1. Call `PriceAware.getCurrentPriceInPeg(token, inAmount, forceCurBlock=true)` after the update window has passed to force a price recompute.
2. The price is computed by simulating a Uniswap-like trade using current pair reserves.
3. Flash-loan to drastically shift the pair reserves before the call, yielding an almost arbitrary output amount and thus price.
**How found:** Noticed the price update path simulates a Uniswap trade on live reserves, which are flash-loan manipulable, and that anyone can force the update.
**Exploitation:** Attacker flash-loans to skew Uniswap pair reserves, triggers a forced price update so the simulated trade returns a manipulated price, then uses the wrong price against borrowing-on-margin and liquidation logic.
**Insight:** Any oracle that simulates a spot swap against live AMM reserves is flash-loan manipulable; check whether price reads use spot reserves vs cumulative/TWAP values, and whether anyone can force a recompute.