# Oracle may be attacked if an attacker can pump the tokens for the entire block

Canto stableswap TWAP oracle's `current` price averages over as little as one block, letting an attacker pump reserves for a single block and manipulate the oracle.

- Payout: Audit contest
- Severity: medium
- Program: Canto
- Found by: Chom
- Disclosed: 2022-10-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-newblockchain-findings/issues/233
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-canto%3AM-10
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:oracle-manipulation

**Target:** BaseV1-core.sol stableswap TWAP oracle (current/update)
**Root cause:** `current` computes TWAP from the last observation, which can be stamped in the immediately preceding block, so timeElapsed can be ~1 block; a single-block reserve pump then dominates the average.
**Steps:**
1. Wait until just after periodSize (1800 min) so `_update` pushes a new Observation at block N.
2. In block N+1, pump the pair reserves (large capital / flash loan) to spike reserve0Cumulative/reserve1Cumulative.
3. Call `current`: `_observation` is block N, timeElapsed ≈ 1 block, so `_reserve0/_reserve1` reflect the pumped price.
4. Consume the manipulated oracle price in a dependent protocol to extract value.
**How found:** Code review of `_update`/`current`: noticed observation is pushed when timeElapsed > periodSize, and `current` divides cumulative delta by timeElapsed which can be a single block, making the TWAP window trivially small.
**Exploitation:** Attacker uses large capital to pump token price in a liquidity pair for one full block, timed so the TWAP window covers only that block, then exploits any protocol pricing off `current` (analogous to Inverse Finance April 2022 attack).
**Insight:** When auditing TWAP oracles, check the minimum possible window between the last observation and query time; if an observation can be stamped in the prior block, the effective TWAP collapses to one block and is pumpable.