# Stale price used when citadelPriceFlag is cleared

When oracle price is out of bounds, citadelPriceFlag is set but price not stored; clearing the flag reuses a stale price, enabling mispricing.

- Payout: Audit contest
- Severity: medium
- Program: BadgerDAO
- Credited: IllIllI
- Disclosed: 2022-07-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-04-badger-citadel-findings/issues/176
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-badger-citadel%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Funding.sol oracle price update logic
**Root cause:** Out-of-range oracle price sets citadelPriceFlag but does not store the new price; clearCitadelPriceFlag() then resumes with the previous stale citadelPriceInAsset.
**Steps:**
1. Observe Funding.sol lines 427-437: if price < min or > max, only set citadelPriceFlag=true and emit event, no assignment to citadelPriceInAsset
2. Policy ops calls clearCitadelPriceFlag()
3. Subsequent pricing reads use the stale pre-flag citadelPriceInAsset value
**How found:** Code inspection of the price update branch: noticed the out-of-bounds branch sets the flag but never writes the price, so clearing the flag leaves stale state.
**Exploitation:** Policy operations team can clear the flag to force use of a stale price not controlled by the oracle, affecting asset valuations and potentially causing fund loss.
**Insight:** When a guard flag gates a value update, check whether the rejected value is still persisted; clearing the flag may silently resume with stale state rather than the validated new value.