# Balancer oracle uses vault balances as price and can be steered by anyone

BalancerPriceOracle reads raw Vault pool balances as spot price and updatePrice() is permissionless, letting anyone steer the stored average and defeat slippage validation.

- Payout: Contest reward
- Severity: high
- Program: Olas
- Credited: Silvermist
- Disclosed: 2026-05-18
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2026-01-olas#h-03
- Library page: https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:access-control vuln:oracle-manipulation

**Target:** BalancerPriceOracle.sol (getPrice/updatePrice/validatePrice)
**Root cause:** getPrice() returns a raw reserve ratio from Vault balances instead of a Balancer oracle accumulator, and updatePrice() is permissionless, so the stored 'TWAP' snapshot can be driven toward an attacker-controlled spot regime.
**Steps:**
1. Read BalancerPriceOracle.getPrice(): fetches balances via IVault.getPoolTokens and returns balanceOut*1e18/balanceIn (spot ratio).
2. Note updatePrice() has no access control and writes snapshot.averagePrice from current getPrice().
3. Manipulate pool spot (trade) to attacker-favored ratio, call `updatePrice()` repeatedly over time to drag snapshot.averagePrice toward manipulated regime.
4. Call validatePrice(slippage): current spot is near the now-manipulated snapshot, so check passes despite price far from original market reference.
**How found:** Code review of the oracle: noticed getPrice() reads Vault balances directly rather than a Balancer oracle accumulator, and that updatePrice() lacks access control, making the 'TWAP' snapshot steerable.
**Exploitation:** Attacker trades the Balancer pool to a manipulated spot ratio, then permissionlessly calls updatePrice() across blocks to migrate the stored average toward that regime; validatePrice() then approves protocol swaps at the skewed price, enabling value extraction via the mispriced swap.
**Insight:** When auditing a 'TWAP' oracle, check whether it actually consumes an accumulator or just re-reads spot reserves; if the update function is permissionless, the average can be walked toward any regime an attacker can hold.