# Avoidance of Liquidation Via Malicious Oracle

Borrower supplies a malicious oracle at loan request; lender never validates it, so the oracle never returns a liquidating rate and the lender cannot seize collateral.

- Payout: Audit contest
- Severity: high
- Program: Abracadabra Money
- Credited: BowTiedWardens
- Disclosed: 2022-07-18
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-04-abranft-findings/issues/136
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation vuln:oracle-manipulation

**Target:** NFTPairWithOracle lending contract (oracle parameter on loan request)
**Root cause:** Loan construction accepts an arbitrary oracle supplied by the borrower, and `_lend` never checks that the oracle matches the one the lender agreed to. The lender's liquidation path trusts that same oracle.
**Steps:**
1. Borrower calls loan request with `params.oracle` set to a malicious oracle contract.
2. Lender accepts the loan without any oracle comparison in `_lend`.
3. Malicious oracle is coded to never return a liquidating rate on `oracle.get`.
4. Lender calls `removeCollateral` to liquidate; the check at NFTPairWithOracle.sol L288 fails, blocking seizure.
5. Lender would need to atomically swap in an honest oracle and call `removeCollateral` to whitehat-recover.
**How found:** Code review of the loan-request and `_lend` flow: noticed the oracle is a caller-supplied parameter and that no equality check against the lender's accepted oracle exists before the liquidation path relies on it.
**Exploitation:** Borrower takes a loan against NFT collateral using a self-controlled oracle that reports a permanently healthy price, so the loan can never be liquidated and the borrower keeps the borrowed funds while retaining the NFT.
**Insight:** When a lending flow lets the borrower pass configuration (oracle, fee recipient, hook) that the lender's later actions depend on, check whether acceptance validates that config against what the lender saw; unvalidated borrower-controlled oracles turn liquidation into a no-op.