# Uniswap oracle validateprice can be griefed per block via sync()

UniswapPriceOracle.validatePrice rejects any pair whose blockTimestampLast equals current block.timestamp, so an attacker front-running with sync() griefs victim transactions per block.

- Payout: Contest reward
- Severity: medium
- Program: Olas
- Credited: Silvermist
- Disclosed: 2026-05-18
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2026-01-olas#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos vuln:oracle-manipulation

**Target:** UniswapPriceOracle.sol validatePrice() / Uniswap V2 pair
**Root cause:** validatePrice() returns false whenever the pair's blockTimestampLast equals block.timestamp, treating a same-block reserve update as invalid rather than checking staleness.
**Steps:**
1. Victim submits a transaction calling validatePrice() against a Uniswap V2 pair via public mempool.
2. Attacker front-runs in the same block by calling pair.sync(), which sets blockTimestampLast = block.timestamp.
3. Victim's tx executes; getReserves() returns blockTimestampLast == block.timestamp, so validatePrice() returns false.
4. Attacker repeats sync() front-run each block the victim retries.
**How found:** Code reading of validatePrice() revealed the block.timestamp == blockTimestampLast rejection, combined with knowledge that Uniswap V2 sync() sets blockTimestampLast to the current block timestamp, enabling a same-block griefing front-run.
**Exploitation:** Mempool attacker front-runs victim with a permissionless Uniswap V2 sync() in the same block, forcing validatePrice() to return false and causing consistent per-block failures for any public-mempool execution.
**Insight:** When an oracle rejects same-block updates, remember Uniswap V2 sync() is permissionless and cheaply sets blockTimestampLast to now — any 'freshness' check keyed on equality with block.timestamp becomes a griefing vector via front-run.