# A malicious admin can steal all users collateral

Admin can swap a collateral's price oracle wrapper without timelock, set price to 1, and liquidate all users' collateral for negligible TAU.

- Payout: Contest reward
- Severity: medium
- Program: Taurus
- Credited: J4de
- Disclosed: 2023-02-08
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-taurus-judging/issues/43
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-taurus%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:access-control vuln:liquidation vuln:oracle-manipulation

**Target:** PriceOracleManager / BaseVault liquidation
**Root cause:** updateWrapper() is onlyOwner with no timelock, letting admin point any underlying to an arbitrary oracle that returns a manipulated price.
**Steps:**
1. Deploy malicious IOracleWrapper returning price=1 when tx.origin==attacker, else real GLP price
2. As owner call `updateWrapper(underlying, attackOracle)`
3. Call `liquidate(victim, debtAmount, minExchangeRate)` on BaseVault; low price makes victim unhealthy
4. Receive victim collateral via safeTransfer, burning negligible TAU
**How found:** Compared contest scope statement ('Multisig trusted with everything but user collateral') against updateWrapper() lacking timelock, hypothesizing admin could manipulate prices to force liquidations.
**Exploitation:** Malicious admin registers a fake oracle wrapper that reports near-zero price for the collateral, making every account appear undercollateralized; then calls liquidate() to seize collateral at negligible TAU cost.
**Insight:** When a protocol's stated trust model excludes user collateral from admin powers, audit every onlyOwner setter that feeds liquidation/health math (oracles, fee multipliers, thresholds) for missing timelocks.