# Any oracle update with sufficiently big price decline can be sandwiched to extract value from the protocol

Morpho Blue's fixed liquidation incentive lets an attacker front-run a sharp oracle price drop with a max-LLTV borrow, then self-liquidate, pocketing the difference as bad debt.

- Payout: Contest reward
- Severity: medium
- Program: Morpho Blue
- Credited: hyh
- Disclosed: 2024-09-28
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_morpho_blue_dec2023.pdf#3.2.7
- Library page: https://bugbountylibrary.com/r/cantina%3Amorpho_blue_dec2023%3A3.2.7
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm technique:source-review vuln:business-logic vuln:flash-loan vuln:liquidation vuln:oracle-manipulation

**Target:** Lending market liquidation/oracle price path (Morpho.sol liquidate)
**Root cause:** Liquidation incentive factor is fixed and LLTV is immutable per market, so a single large oracle price decline can make a freshly opened max-LLTV position immediately unhealthy, letting the borrower self-liquidate at a profit and socialize the shortfall as bad debt.
**Steps:**
1. Identify a market whose LLTV is too high for current collateral volatility (e.g. USDC/USDT at 95%).
2. Observe pending oracle update tx2 that sharply lowers collateral price (e.g. 0.9136 USDT/USDC).
3. tx1: front-run, supply 1m USDC collateral, borrow 0.95m USDT at max LLTV.
4. tx2: oracle update executes, position becomes unhealthy.
5. tx3: back-run, self-liquidate repaying 0.9m USDT, seizing 0.9m*1.01522/0.9136 = 1m USDC collateral.
6. Withdraw collateral; keep 0.05m USDT profit, which is written off as bad debt to lenders.
**How found:** Code reading of liquidate(): collateralPrice read from oracle, health check against that price, and fixed liquidationIncentiveFactor derived from immutable LLTV. Realized that a single oracle step-down can make a just-opened max-LLTV loan liquidatable, and that self-liquidation plus fixed incentive turns the shortfall into attacker profit.
**Exploitation:** Attacker needs only to sandwich the oracle update: borrow at max LLTV before the price drop, self-liquidate after. Liquidation pays the fixed incentive factor (1/(1-cursor*(1-lltv))) and the residual debt is socialized as bad debt, so the attacker pockets the gap between debt and seized collateral value.
**Escalation:** Works on any market where a single oracle update can create bad debt; scales with market TVL and frequency of sharp price moves.
**Insight:** In lending protocols with immutable per-market LLTV and fixed liquidation bonuses, check whether one oracle update can flip a max-LLTV position unhealthy; if so, the borrower can self-liquidate profitably and dump bad debt on lenders. Look for markets where LLTV was set for lower historical volatility.