# The use of spot price by CoreSaltyFeed can lead to price manipulation and undesired liquidations

CoreSaltyFeed spot price is manipulable; attacker nudges it below Chainlink so PriceAggregator averages low, triggering unfair liquidations for 5% rewards.

- Payout: Contest reward
- Severity: high
- Program: Salty.IO
- Credited: 00xSEV
- Disclosed: 2024-04-19
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2024-01-salty-findings/issues/609
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AH-03
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained vuln:oracle-manipulation

**Target:** CoreSaltyFeed / PriceAggregator oracle and CollateralAndLiquidity liquidation
**Root cause:** PriceAggregator averages CoreSaltyFeed's manipulable spot price with Chainlink; a small spot-price push below Chainlink skews the average low enough to make healthy positions liquidatable.
**Steps:**
1. Set up pools (tokenA/WETH, tokenA/WBTC, WBTC/WETH) with ~1000 ETH liquidity each.
2. Split a swap into 100 steps via `pools.depositSwapWithdraw(tokenA, weth, amount/steps, 0, ...)` to move CoreSaltyFeed price ~3% cheaply (~0.0036 ETH).
3. PriceAggregator averages manipulated spot ($38,000) with Chainlink ($38,800) to $38,400, below TWAP ($40,000).
4. Call `liquidate` on positions now deemed undercollateralized, collecting 5% reward (max $500).
5. Optionally swap back to recover most of the manipulation cost.
**How found:** Observed that Chainlink updates instantly while TWAP lags, so CoreSaltyFeed spot can be pushed within the TWAP-Chainlink gap; computed manipulation cost via PoC showing ~0.0036 ETH for 3% move on 1000 ETH pools.
**Exploitation:** Attacker flash/self-funds a multi-step swap to push CoreSaltyFeed spot price down ~3% (cheaper than the TWAP-Chainlink gap), then in the same transaction calls liquidate on positions that are actually healthy, earning the 5% liquidation reward while honest liquidators cannot act.
**Escalation:** During Chainlink outages or sudden BTC/ETH crashes, attacker can mint undercollateralized USDS since the 200% collateral ratio relies on the stale TWAP plus manipulated spot price.
**Insight:** When an aggregator averages a manipulable spot feed with a lagging TWAP/Chainlink, the profitable manipulation window is the gap between them—push spot just inside that gap, not past it, to minimize cost while still skewing the average.