# ERC4626Oracle Vulnerable To Price Manipulation

ERC4626Oracle.getPrice derives LP token price from spot previewRedeem/totalAssets, manipulable within one block to inflate collateral or trigger liquidations.

- Payout: Contest reward
- Severity: medium
- Program: Sentiment
- Credited: xiaoming90
- Disclosed: 2022-08-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-08-sentiment-judging/tree/main/133-M
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-08-sentiment%3AM-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation vuln:oracle-manipulation

**Target:** ERC4626Oracle.getPrice / ERC4626 vault share pricing
**Root cause:** getPrice uses ERC4626.previewRedeem which calls convertToAssets computing assets-per-share from spot totalAssets()/totalSupply, both movable within a single transaction via deposit/mint/withdraw/redeem.
**Steps:**
1. Read ERC4626Oracle.getPrice: returns previewRedeem(10**decimals) * oracleFacade.getPrice(asset) / 10**decimals
2. Note previewRedeem -> convertToAssets -> shares.mulDivDown(totalAssets(), totalSupply)
3. Attacker deposits/mints or withdraws/redeems in same tx to skew totalAssets vs totalSupply ratio
4. Oracle price of the ERC4626 LP token inflates or deflates within the block
5. Use inflated collateral to borrow beyond limit, or deflated price to force premature liquidation
**How found:** Code review of getPrice traced the price dependency to previewRedeem -> convertToAssets, observing that totalAssets() and totalSupply are spot values mutable within one block.
**Exploitation:** Within a single transaction, attacker manipulates the vault's totalAssets/totalSupply ratio via deposit/mint/withdraw/redeem so previewRedeem returns a skewed share price; Sentiment's oracle then reports inflated collateral value (enabling over-borrowing) or deflated value (enabling premature liquidation of another account).
**Insight:** When auditing oracle adapters, trace every price input to its ultimate source; any dependence on a vault's live totalAssets/totalSupply (share price) is single-block manipulable and needs TWAP or manipulation-resistant accounting.