# Two day low oracle used in Market.liquidate() makes the system highly at risk in an oracle attack

Market.liquidate() prices collateral using a two-day low oracle, so a brief price-feed manipulation lets attackers liquidate healthy debt and overpay liquidator rewards.

- Payout: Audit contest
- Severity: medium
- Program: Inverse Finance
- Found by: gs8nrv
- Disclosed: 2022-12-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-10-inverse#m-14
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-14
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:liquidation vuln:oracle-manipulation

**Target:** Market.liquidate() oracle price feed (DOLA/ETH lending market)
**Root cause:** Liquidation uses the two-day lowest exchange rate rather than the current price, and the same low value also drives the liquidator reward calculation, so a transient feed manipulation persists for two days and inflates collateral released.
**Steps:**
1. Manipulate the price feed (directly, or by moving Chainlink markets to force an update) to push a bad low price.
2. Call `Oracle.getPrice()` so the two-day low records the manipulated value.
3. Within the two-day window call `Market.liquidate()` on any escrow; the low price is used at line 596 and the liquidator reward at line 597.
4. Liquidator receives more collateral than warranted (e.g. ETH/USD pushed to 20 instead of 2000 yields ~100 extra).
**How found:** Code review of Market.liquidate() lines 594-597 noting the two-day low oracle is reused for both liquidation pricing and the liquidator reward computation.
**Exploitation:** Attacker controls the feed briefly, seeds a depressed two-day low, then liquidates positions during the window, collecting oversized liquidator rewards and releasing excess collateral.
**Insight:** When a protocol reuses one oracle value for both solvency checks and reward sizing, a stale/extreme-low feed amplifies payout; check whether liquidation price and reward share the same manipulable source.