# Oracle’s two-day feature can be gamed

Inverse Finance oracle's two-day low uses integer day boundaries, so manipulating at the last block of one day and first of the next bypasses the two-day window.

- Payout: Audit contest
- Severity: medium
- Program: Inverse Finance
- Found by: Ruhum
- Disclosed: 2022-12-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-10-inverse#m-07
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-07
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:business-logic vuln:oracle-manipulation

**Target:** Oracle.sol price oracle (day-bucketed low)
**Root cause:** Oracle buckets observations by `block.timestamp / 1 days` integer division, so two adjacent blocks straddling midnight fall into different days, letting a two-block manipulation satisfy the two-day low requirement.
**Steps:**
1. Read Oracle.sol#L124: `uint day = block.timestamp / 1 days;`
2. Manipulate the underlying oracle at the last block of day X (e.g. 23:59:50).
3. Manipulate again at the first block of day X+1 (e.g. 00:00:02).
4. The two observations land in different day buckets, so the two-day feature is satisfied with only ~2 blocks of manipulation.
**How found:** Noticed the day is computed via integer division of timestamp, and reasoned that adjacent blocks straddling a day boundary count as separate days, defeating the intended multi-day manipulation resistance.
**Exploitation:** Attacker manipulates the underlying oracle across the midnight boundary in two consecutive blocks to satisfy the two-day low check, then exploits the manipulated price; requires the underlying oracle to be manipulable and a 24h gap without oracle calls.
**Insight:** When a protocol enforces a time-window security property by bucketing timestamps with integer division, check whether two adjacent blocks straddling a bucket boundary satisfy the window; bucket-boundary straddling can collapse an N-day requirement to two blocks.