# Critical Logic Inversion in Price Guard Allows Flash-Loan Manipulation of Liquidity Operations

Inverted maturity check and fail-open TWAP fallback in Olas LiquidityManagerCore let flash-loan-manipulated slot0 prices bypass the price guard, draining POL assets.

- Payout: Contest reward
- Severity: high
- Program: Olas
- Credited: prazzix86
- Disclosed: 2026-05-18
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2026-01-olas#h-08
- Library page: https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AH-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** LiquidityManagerCore.sol checkPoolAndGetCenterPrice (Uniswap V3 POL module)
**Root cause:** The maturity condition `oldestTimestamp + SECONDS_AGO < block.timestamp` returns slot0 price for mature pools instead of verifying TWAP, and the staticcall failure path returns untrusted slot0 price (fail-open) instead of reverting.
**Steps:**
1. Identify a liquidity operation path (e.g. ConvertedToV3) that calls `checkPoolAndGetCenterPrice`.
2. Create a fresh Uniswap V3 pool for OLAS/SHITCOIN with < 30 min history.
3. Flash-loan and buy OLAS in the new pool to push slot0 price ~100x fair value.
4. Trigger the protocol to provide liquidity to this pool.
5. `checkPoolAndGetCenterPrice` calls `getTwapFromOracle`; `observe([1800,0])` reverts on the young pool.
6. staticcall returns `success=false`, code returns manipulated `centerSqrtPriceX96`.
7. Protocol mints/converts at 100x price; attacker drains OLAS for worthless tokens.
**How found:** Code review of the price guard: noticed the maturity comparison direction returns slot0 for pools that DO have TWAP data, and that the staticcall failure branch returns untrusted price rather than reverting.
**Exploitation:** Attacker flash-loans capital, creates a new OLAS/SHITCOIN V3 pool, buys OLAS to inflate slot0 ~100x, then triggers the protocol's liquidity operation. The TWAP observe call reverts due to insufficient pool history, the fail-open branch returns the manipulated slot0 price, and the protocol mints/converts at the inflated price, letting the attacker extract OLAS in exchange for worthless tokens.
**Escalation:** Repeatable across any liquidity operation routed through the flawed guard; mature pools also bypass via the inverted history check.
**Insight:** When auditing TWAP/oracle guards, check the direction of maturity comparisons and every error-handling branch: a staticcall catch that returns the spot price turns any oracle revert into a bypass, and young pools are the easiest way to force that revert.