# The TWAP price will be incorrect due to the wrong update of the oracle

Fluid DEX oracle ring buffer overwrites maps without clearing stale slots, corrupting TWAP time/price deltas when wrapping around.

- Payout: Contest reward
- Severity: medium
- Program: Instadapp
- Credited: etherSky
- Disclosed: 2025-01-07
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_instadapp_september2024.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Ainstadapp_september2024%3A3.1.1
- Tags: domain:web3 impact:integrity kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Fluid DEX on-chain TWAP oracle (_updateOracle ring buffer)
**Root cause:** When the oracle ring buffer wraps to a new map, the map is not zeroed before partial slot writes, so leftover bits from prior data OR into new time/price deltas.
**Steps:**
1. Deploy pool with small TOTAL_ORACLE_MAPPING (e.g. 10) and fill all maps via swaps with skip(600) so two slots written per update.
2. Wrap around to map 0; advance until next slot is [0.0] with timeDiff 100.
3. Perform swap with skip(800) so only one slot [0.0] is written, then map advances to [1.7] without clearing map 1.
4. Next update with timeDiff 800 writes two slots [1.7,1.6] OR-ing into stale map 1 data.
5. Read slot [1.7]: timeDiff shows 809 instead of 801 (old bits 8 OR'd in); price diff shows 300 instead of 4.
**How found:** Code reading of _updateOracle slot/map bookkeeping; noticed map advance lacks clearing, hypothesized stale bits persist on wrap, confirmed via PoC logging storage slots.
**Exploitation:** No direct theft described; corrupted TWAP feeds external protocols relying on Fluid's oracle, enabling mispricing if manipulated.
**Insight:** In packed ring-buffer oracles, verify every map/slot is zeroed on wrap; OR-based bit packing leaks stale bits into time/price deltas, detectable by comparing expected vs stored deltas after wrap.