# Fallback oracle is using spot price in Uniswap liquidity pool, which is very vulnerable to flashloan price manipulation

ParaSpace fallback oracle reads Uniswap V2 spot reserves, letting a flashloan distort collateral price and overborrow, leaving bad debt.

- Payout: Contest reward
- Severity: medium
- Program: ParaSpace
- Credited: ladboy233
- Disclosed: 2023-04-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-paraspace-findings/issues/242
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:flash-loan vuln:oracle-manipulation

**Target:** ParaSpaceOracle / ParaSpaceFallbackOracle price feed
**Root cause:** Fallback oracle derives asset and ETH/USD prices from Uniswap V2 pair reserves via getAmountOut, i.e. instantaneous spot price, with no TWAP or sanity check.
**Steps:**
1. Trigger oracle failure so assetsSources[asset] returns 0, forcing getAssetPrice to call _fallbackOracle.getAssetPrice(asset).
2. Fallback reads Uniswap V2 pair reserves for (WETH, asset) and computes price via getAmountOut(10**decimals, tokenReserves, ethReserves).
3. Flashloan large capital and swap into the (WETH, asset) pair to inflate tokenReserves/ethReserves ratio, raising reported collateral price.
4. Deposit/borrow against inflated collateral to overborrow ETH.
5. Repay flashloan, unwind swap to restore price, leaving insolvent position/bad debt.
**How found:** Code review of ParaSpaceOracle.getAssetPrice fallback path into ParaSpaceFallbackOracle, noticing it uses Uniswap V2 getReserves spot price rather than a manipulation-resistant source.
**Exploitation:** Attacker waits for primary oracle to fail, flashloans to skew the Uniswap V2 pool reserves used by the fallback oracle, borrows far more than collateral is worth, repays flashloan and restores pool price, leaving ParaSpace with bad debt.
**Insight:** When auditing oracle fallback paths, check whether the backup source is spot-price based (Uniswap V2 reserves) — a fallback that only activates on primary failure is still exploitable because the attacker can wait for or induce that condition and flashloan the pool.