# Critical Oracle Manipulation Risk by Lender

Lender in Abracadabra NFTPairWithOracle can swap the price oracle after a loan is outstanding, faking a low collateral rate to seize valuable NFTs.

- Payout: Audit contest
- Severity: high
- Program: Abracadabra Money
- Credited: 0x1337
- Disclosed: 2022-07-18
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-04-abranft-findings/issues/37
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** NFTPairWithOracle lending contract (Solidity)
**Root cause:** updateLoanParams() validates new params but never checks that params.oracle equals the current oracle, so a lender can replace the oracle after LOAN_OUTSTANDING.
**Steps:**
1. Borrower calls `requestLoan()` setting params including oracle; lender calls `lend()` -> status LOAN_OUTSTANDING.
2. Collateral value rises above principal+interest, giving lender incentive to seize.
3. Lender calls `updateLoanParams()` with own params containing a malicious oracle; require block at L205-211 lacks `params.oracle == cur.oracle` check.
4. New oracle returns artificially low `rate` at L287 so the L288 check passes.
5. Lender seizes the now-undervalued collateral, harming borrower.
**How found:** Code review of updateLoanParams require conditions; noticed oracle field was not among the immutability checks, then traced how the oracle feeds the seizure rate check at L286-288.
**Exploitation:** Malicious lender waits until collateral appreciates past debt, swaps in a controlled oracle via updateLoanParams, reports a low rate, and triggers seizure of the NFT collateral at borrower's expense.
**Insight:** When a struct of loan params is mutable post-agreement, enumerate every field that affects value transfer (oracle, fee, LTV) and verify each is pinned; oracle address is easy to overlook versus numeric params.