# Rogue validators can manipulate funding rates and profit unfairly from liquidations

Hubble Exchange order-matching validators can self-match liquidations at worse prices and skew markPriceTwap to manipulate funding, extracting value from users.

- Payout: Contest reward
- Severity: high
- Program: Hubble Exchange
- Credited: 0x52
- Disclosed: 2023-04-16
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-04-hubble-exchange-judging/issues/183
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-hubble-exchange%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm technique:source-review vuln:business-logic vuln:liquidation vuln:oracle-manipulation

**Target:** OrderBook.sol order matching / liquidation engine
**Root cause:** Validators have exclusive order-matching privilege with no enforced fairness; they may match liquidations against their own orders up to 20% from oracle and place tiny trades at spread extremes to skew markPriceTwap.
**Steps:**
1. Validator observes a liquidation needing to sell 100 ETH at mark price 2000 with available orders at 2000.
2. Instead of matching to existing orders, validator creates own order at 1980 and matches the liquidation to it.
3. Validator immediately sells/matches against the 2000 orders, netting ~2000 USDC profit.
4. For funding: place and match tiny orders at the 20% spread extremes to push markPriceTwap, skewing funding rate.
5. Max funding rates liquidate leveraged positions, which validator then profits from via step 2.
**How found:** Code review of OrderBook.sol matching logic (L215-258) noting validators exclusively match orders and can choose counterparties; reasoned about trust assumptions of AVAX validator set (no slashing, USDC gas token, permissionless staking) to show anyone can become a validator.
**Exploitation:** A single malicious validator, when it is its turn to produce a block, matches a user's liquidation against its own worse-priced order and immediately resells to resting orders, capturing the spread. No consensus rules are broken so honest validators accept the block; AVAX validators cannot be slashed and gas token is USDC so no stake depreciation deterrent.
**Escalation:** Funding-rate manipulation via TWAP skew can force liquidations of leveraged positions, feeding further liquidation-profiteering; effective in low-liquidity conditions.
**Insight:** When a privileged role exclusively controls order matching or price observation, check whether it can self-match user flow at worse prices or nudge a TWAP within allowed spread bounds; also audit the chain's validator economics (slashing, gas token volatility) to see if misbehavior is actually deterred.