# Oracle can be manipulted to consider only a single pair for pricing

Vader's LiquidityBasedTWAP oracle weights pools by flashloan-manipulable TVL, letting an attacker make one pool dominate USDV/VADER pricing.

- Payout: Audit contest
- Severity: medium
- Program: Vader Protocol
- Found by: TomFrenchBlockchain
- Disclosed: 2022-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-vader-findings/issues/40
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AM-06
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:flash-loan vuln:oracle-manipulation

**Target:** LiquidityBasedTWAP oracle / liquidity pool pricing
**Root cause:** Pool TVL is computed from current reserves times oracle prices; skewing reserves via flashloan inflates currentLiquidityEvaluation so one pair dominates the aggregate oracle result.
**Steps:**
1. Identify LiquidityBasedTWAP computes each pool's TVL from reserves * asset prices (L353-383).
2. Flashloan to skew reserves of a chosen pair, inflating its currentLiquidityEvaluation arbitrarily.
3. Other pairs then contribute negligibly to the oracle aggregate.
4. If that pair's chainlink feed is faulty/deprecated, force oracle to price USDV/VADER solely off the manipulated pool.
**How found:** Code review of the TVL calculation in LiquidityBasedTWAP, recognizing that reserve-derived TVL is flashloan-manipulable and that weighting by it lets a single pair dominate the aggregate.
**Exploitation:** Attacker flashloans to skew reserves of one pool so its TVL dominates the oracle weighting; combined with a malfunctioning chainlink feed for that asset, the oracle prices USDV/VADER from the attacker-influenced pool. No direct fund loss claimed.
**Insight:** When an oracle aggregates prices weighted by pool TVL, check whether TVL derives from spot reserves; a flashloan can inflate one pool's weight to drown out all others, especially dangerous if any single feed is stale.