# `quoteAllAvailablePoolsWithTimePeriod` can be manipulated with low liquidity pools

JOJO's mark price oracle averaged ticks across all Uniswap V3 pools including two low-liquidity WBTC/USDC pools, letting an attacker skew the weighted mean and manipulate perpetual prices.

- Payout: Contest reward
- Severity: medium
- Program: Jojo
- Credited: ArbitraryExecution
- Disclosed: 2023-04-11
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-jojo-judging/issues/438
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-jojo%3AM-11
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm technique:source-review vuln:dos vuln:oracle-manipulation

**Target:** Uniswap V3 StaticOracle price adaptor (uniswapPriceAdaptor.sol)
**Root cause:** quoteAllAvailablePoolsWithTimePeriod pulls every applicable Uniswap V3 pool dynamically and takes a weighted arithmetic mean of ticks; arithmetic mean is outlier-sensitive, and two of three WBTC/USDC pools on Arbitrum have low liquidity.
**Steps:**
1. Identify JOJO's StaticOracle at 0xb210ce856631eeeb767efa666ec7c1c57738d438 on Arbitrum and the WBTC/USDC pools it returns: 0xac70bD92F89e6739B3a08Db9B6081a923912f73D, 0xA62aD78825E3a55A77823F00Fe0050F567c1e4EE, 0x83450968eC7606F98Df1C170f8C922d55A13f236
2. Confirm two of the three pools have low liquidity
3. Swap in the low-liquidity pools to push their ticks far from the true price
4. Observe getMarkPrice in uniswapPriceAdaptor.sol returning a skewed weighted arithmetic mean
5. Use the skewed mark price to arbitrage JOJO perpetuals or push the price beyond the allowed difference to DOS the adaptor and emergencyOracle fallback
**How found:** Code review of getMarkPrice in uniswapPriceAdaptor.sol revealed it calls quoteAllAvailablePoolsWithTimePeriod, which dynamically aggregates all pools; the researchers then checked the actual Arbitrum pools returned for WBTC/USDC and found two of three had low liquidity, turning a theoretical manipulation into a real vector.
**Exploitation:** Attacker trades in the low-liquidity Uniswap V3 pools to move their ticks, skewing the weighted arithmetic mean returned by quoteAllAvailablePoolsWithTimePeriod; the manipulated mark price is then used for JOJO perpetuals, enabling arbitrage against the protocol and increasing counterparty risk.
**Escalation:** If the manipulated price exceeds JOJO's allowed difference, the uniswapPriceAdaptor and emergencyOracle fallback mechanism can be permanently DOSed, removing the backup to Chainlink.
**Insight:** When an oracle averages across dynamically discovered pools, enumerate the actual pools on-chain and check each one's liquidity — a single thin pool in the set is enough to drag an arithmetic mean, so the fix is to whitelist specific deep pools rather than trust pool discovery.