# BalancerPriceOracle::validatePrice uses stale TWAP

BalancerPriceOracle.validatePrice reads stale TWAP snapshots never refreshed by updatePrice, letting BuyBackBurner and LiquidityManagerOptimism validate against outdated prices, enabling DoS or sandwich manipulation.

- Payout: Contest reward
- Severity: medium
- Program: Olas
- Credited: santipu_
- Disclosed: 2026-05-18
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2026-01-olas#m-05
- Library page: https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-05
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos vuln:oracle-manipulation

**Target:** Solidity oracle contract (BalancerPriceOracle) and dependent BuyBackBurner/LiquidityManagerOptimism
**Root cause:** validatePrice() is a view function that computes TWAP from snapshot.averagePrice/cumulativePrice without calling updatePrice(), so elapsedTime grows unboundedly and stale averagePrice dominates the result.
**Steps:**
1. Observe validatePrice() reads snapshot.averagePrice and snapshot.cumulativePrice but never calls updatePrice()
2. Note updatePrice() is public with no incentive, so it may go uncalled for long periods
3. Confirm callers BuyBackBurner._buyOLAS and LiquidityManagerOptimism._checkTokensAndRemoveLiquidityV2 invoke validatePrice() without refreshing first
4. Let oracle go stale 24h; TWAP extrapolates from old price X while spot is Y
5. validatePrice() returns false (DoS) or true against manipulated spot matching stale TWAP (sandwich)
6. Exploit via sandwich around buyback/withdrawal when stale TWAP aligns with manipulated spot
**How found:** Code review of validatePrice() noting it is a view function reading snapshot fields without invoking updatePrice(), then tracing callers to confirm neither refreshes the oracle before validation.
**Exploitation:** Attacker waits for stale oracle state, manipulates spot price to align with stale TWAP so validatePrice() passes, then sandwiches the BuyBackBurner buyback or LiquidityManager withdrawal to extract value; alternatively stale TWAP blocks legitimate operations causing DoS.
**Insight:** When auditing oracle-gated slippage checks, verify the view validation path actually refreshes cumulative/TWAP state; a public permissionless updatePrice() with no incentive is a red flag that stale snapshots will be trusted.