# Deviation in oracle price could lead to arbitrage in high lltv markets

Chainlink oracle deviation in high-LLTV Morpho Blue markets lets an attacker front-run a price update, borrow, then self-liquidate for profit at lenders' expense.

- Payout: Contest reward
- Severity: medium
- Program: Morpho Blue
- Credited: MiloTruck
- Disclosed: 2024-09-28
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_morpho_blue_dec2023.pdf#3.2.1
- Library page: https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm technique:chained vuln:business-logic vuln:liquidation vuln:oracle-manipulation

**Target:** Lending market oracle (ChainlinkOracle price())
**Root cause:** Oracle prices lag real-time price; multiple chained Chainlink feeds each with deviation thresholds amplify max deviation beyond 1/LIF - LLTV, enabling profitable self-liquidation arbitrage.
**Steps:**
1. Set up market with WBTC collateral, FTM loan, 95% LLTV, ChainlinkOracle with 4 feeds at 2%/0.5%/3%/0.5% deviation thresholds.
2. Compute max deviation: (0.98*39800)/(0.000515*2010)=37680 vs 40000 => 5.8% deviation.
3. Attacker deposits 1 WBTC and borrows 38000 FTM at stale oracle price (1 WBTC=40000 FTM).
4. Oracle updates to 1 WBTC=37680 FTM; position becomes unhealthy.
5. Attacker self-liquidates: repays 37115 FTM to seize 1 WBTC, netting 885 FTM (~2.3%).
**How found:** Reasoned about oracle lag (Chainlink deviation thresholds, Uniswap V3 TWAP averaging) and derived the mathematical condition for profitable arbitrage: price deviation > 1/LIF - LLTV; noted chained feeds compound deviation.
**Exploitation:** Attacker front-runs the oracle price update: deposits collateral, borrows max at stale favorable price, waits for oracle update making position unhealthy, then back-runs by liquidating own position to seize collateral cheaper than repaid debt, extracting profit socialized as bad debt to lenders.
**Insight:** When auditing lending markets, compute the oracle's worst-case compounded deviation across all chained feeds and compare to 1/LIF - LLTV; if deviation exceeds it, self-liquidation arbitrage is profitable and bad debt is socialized to lenders.