# Adversary can sandwich oracle updates to exploit vault

BLVaultLido's oracle-price arb siphon can be bypassed by sandwiching the Chainlink oracle update, letting an attacker repeatedly drain wstETH from the vault.

- Payout: Contest reward
- Severity: high
- Program: Olympus
- Credited: 0x52
- Disclosed: 2023-03-16
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2023-03-olympus-judging/issues/1
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-olympus%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:oracle-manipulation

**Target:** BLVaultLido deposit/withdraw vault with wstETH/OHM oracle pricing
**Root cause:** The vault caps returned wstETH at the current oracle price to siphon arb profit, but the oracle price is predictable before its update, so an attacker can pre-position the pool to match the upcoming price and withdraw the full amount.
**Steps:**
1. Note Chainlink 0.5% deviation threshold; current pool price 0.995 wstETH/OHM, oracle still 1:1 about to update to 0.995.
2. Tx1: swap OHM to move pool to pre-update oracle price (80 OHM/80 wstETH), deposit liquidity (100/100), then sell wstETH for OHM to move price 0.5% toward post-update value.
3. Oracle update lands: wstETH price set to 0.995 OHM, matching the pool the attacker already balanced.
4. Tx2: withdraw liquidity; since pool price equals oracle, wstethToReturn == wstethAmountOut, no siphon occurs; attacker nets ~20.05 wstETH from 20 wstETH.
5. Repeat each oracle update for compounding losses.
**How found:** Recognized the mitigation relies on the current oracle price, which is predictable before Chainlink's 0.5% deviation update; reasoned an attacker could pre-balance the pool to the post-update price so the siphon check passes.
**Exploitation:** Attacker sandwiches the Chainlink oracle update with two transactions: pre-update swap+deposit+partial sell to align pool with the imminent oracle price, then post-update withdrawal to avoid the arb siphon and extract the full wstETH, profiting on each oracle tick.
**Escalation:** Repeated across every oracle update, compounding losses to the vault.
**Insight:** When a mitigation compares pool output to an oracle price, check whether that oracle price is predictable before its next update (deviation-threshold oracles) — an attacker can pre-position the pool to match the upcoming value and defeat the check.