# Low data feed frequency from Tellor makes your protocol vulnerable to flash loan attacks

Tellor's sparse ETH/USD feed on Optimism can be stalled for ~$240, letting an attacker flash-loan and redeem LUSD against a stale collateral price.

- Payout: Contest reward
- Severity: medium
- Program: Ethos Reserve
- Credited: peritoflores
- Disclosed: 2023-05-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-02-ethos-findings/issues/772
- Library page: https://bugbountylibrary.com/r/c4%3A2023-02-ethos%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:recon technique:source-review vuln:flash-loan vuln:oracle-manipulation

**Target:** Tellor oracle integration in Liquity-style lending protocol
**Root cause:** TellorCaller reads data with a 20-minute dispute window, but Tellor's Optimism feed updates only ~hourly with a 1 TRB base dispute fee, so an attacker can cheaply dispute all updates and force reads of stale prices.
**Steps:**
1. Query `getMultipleValuesBefore(queryId=0x83a7...4992, timestamp=1678147200, maxAge=14400, maxCount=1000)` on Optimism Tellor `0x4603...da45`; observe only 4 updates in 4h
2. Compute stall cost: `1+2+4+8 = 15 TRB ≈ $240` (baseFee 1 TRB on Optimism)
3. Dispute each incoming value via Tellor `dispute` to keep feed stale
4. Wait for a collateral to move ~10% while ETH stays flat
5. Flash-loan ETH on Uniswap, mint LUSD at Ethos, redeem LUSD for the mispriced collateral, swap back to ETH, repay loan
**How found:** Compared Chainlink's deviation-triggered updates to Tellor's optimistic oracle design; noted Liquity's prior instant-read bug; then empirically queried Optimism Tellor to measure actual update frequency and computed the cost-of-stalling from the whitepaper's exponential dispute-fee formula.
**Exploitation:** Attacker stalls Tellor collateral feeds during a Chainlink outage, then flash-loans ETH, mints LUSD, and redeems LUSD for collateral priced off the stale Tellor value, capturing the price delta minus Uniswap fees and redemption fees.
**Escalation:** Attack is repeatable each block while oracle remains stalled; can target falling collateral to mint more LUSD.
**Insight:** For optimistic oracles, measure real on-chain update frequency and reporter stake on the specific L2 rather than trusting the whitepaper's per-block assumption; a low baseFee plus few staked reporters collapses the cost-of-stalling to hundreds of dollars.