# Front-running admin setPrice call allows a single compromised oracle to set any price, allowing the oracle manipulator to drain all protocol funds

A compromised NFTFloorOracle feeder front-runs admin setPrice on a newly unpaused asset, sets an arbitrary first price, deposits the NFT and borrows all protocol funds.

- Payout: Contest reward
- Severity: medium
- Program: ParaSpace
- Credited: carlitox477
- Disclosed: 2023-04-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-paraspace-findings/issues/267
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:access-control vuln:oracle-manipulation

**Target:** NFTFloorOracle price feed contract (setPrice/setPause/addAssets)
**Root cause:** First price for a newly added asset is always accepted as valid (_priorTwap==0 returns true in _checkValidity and _combine), so any single UPDATER_ROLE feeder can finalize an arbitrary price before the admin sets the initial price.
**Steps:**
1. Attacker controls one NFTFloorOracle feeder (UPDATER_ROLE).
2. Bot watches admin calls to `addAssets` and `setPause` for a new asset.
3. On unpause, attacker buys one NFT of the collection.
4. Attacker calls `setPrice(asset, maxTwap)` from the feeder; `_checkValidity` returns true since prior twap is 0, `_combine` returns (true, _twap), `_finalizePrice` sets the inflated price.
5. Attacker deposits the NFT as collateral and borrows all available funds.
**How found:** Code reading of setPrice/_checkValidity/_combine revealed that the first price is unconditionally accepted, and that setPause must precede setPrice, creating a front-runnable window between addAssets and the admin's initial price.
**Exploitation:** Compromised feeder front-runs the admin's initial price setup on a newly listed asset, sets a maximal TWAP, deposits a single cheap NFT, and borrows against the inflated collateral to drain protocol liquidity.
**Escalation:** Bypasses MIN_ORACLES_NUM multi-feeder requirement by exploiting the zero-prior-price path, turning each feeder into a single point of failure.
**Insight:** When an oracle accepts a 'first price' without deviation checks, look for any admin action (unpause, asset add) that opens a window where a single low-privilege updater can seed that first price before the trusted admin does.