# Per-Vault Oracle Overrides Ignored in Slippage Hooks

Gauntlet slippage/daily-loss hooks call OracleRegistry.getQuote with msg.sender=hook, so per-vault oracle overrides are ignored and risk checks use the stale default oracle.

- Payout: Contest reward
- Severity: high
- Program: Gauntlet
- Credited: 0xvangrim
- Disclosed: 2025-08-13
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_gauntlet_jun2025.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Agauntlet_jun2025%3A3.1.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:solidity technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Solidity periphery hooks and OracleRegistry contract
**Root cause:** Hooks call oracleRegistry.getQuote, which resolves the oracle via _getOracleForVault(msg.sender,...); msg.sender is the hook contract, not the vault, so oracleOverrides[hook][base][quote] is unset and the default oracle is used.
**Steps:**
1. Vault calls acceptPendingOracle(base,quote,vault,newOracle), writing oracleOverrides[vault][base][quote].
2. Vault calls a hook such as UniswapV3DexHooks.exactInputSingle.
3. Hook calls _convertToNumeraire -> oracleRegistry.getQuote(amount,token,numeraire).
4. Inside getQuote, msg.sender is the hook, so override lookup misses and default oracle is returned.
5. PoC: mock owner(), set oracle registry/maxDailyLoss/maxSlippagePerTrade for vault, accept 2x-price oracle.
6. Assert oracleRegistry.getQuote as vault returns 2 while hooks.convertToNumeraire returns 1.
7. Call handleBeforeExactInputSingle with amountIn=1e18, amountOutMinimum=1.4e18; 30% real slippage passes the 5% limit.
**How found:** Code reading of the hook-to-registry call path: noticed getQuote resolves the oracle by msg.sender and traced that the caller is the hook contract rather than the vault, then built a mock-hook PoC showing divergent prices.
**Exploitation:** A vault that opted into a corrected oracle still has its slippage and daily-loss limits computed against the stale default feed; a swap with real 30% loss versus the vault's oracle passes the 5% slippage check because the hook undervalues the input token.
**Insight:** When access-control or config lookups key on msg.sender, trace every intermediate caller in a call chain — periphery/hook contracts forwarding calls silently substitute themselves for the vault, silently dropping per-user overrides.