# Maverick oracle can be manipulated

MavEthOracle prices Maverick LP tokens from manipulable pool reserves, letting a flash-loan swap skew the oracle and misprice LMPVault shares.

- Payout: Contest reward
- Severity: high
- Program: Tokemak
- Credited: Bauchibred
- Disclosed: 2023-06-30
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-06-tokemak-judging/issues/635
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-tokemak%3AH-15
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:flash-loan vuln:oracle-manipulation

**Target:** MavEthOracle.getPriceInEth / Maverick boosted position
**Root cause:** getPriceInEth derives LP token value from spot reserves of the Maverick pool multiplied by root oracle prices; reserves shift with pool price, so a large swap moves the computed price.
**Steps:**
1. Fork mainnet at block 17224221; deploy SystemRegistry, AccessController, RootPriceOracle, MavEthOracle.
2. Register SwEthEthOracle for swETH and EthPeggedOracle for WETH in rootOracle.
3. Read reserves and `mavOracle.getPriceInEth(boostedPosition)` before.
4. `deal` 1e24 swETH to attacker; call `IPool(pool).swap(attacker, 1e18, false, false, 0, abi.encode(swETH))` with swapCallback transferring swETH.
5. Re-read reserves and getPriceInEth; price differs from before, confirming manipulation.
**How found:** Code review of MavEthOracle: noticed price is computed from live pool reserves rather than a manipulation-resistant source, hypothesized a swap could move reserves and tested with a Foundry fork PoC.
**Exploitation:** Attacker flash-loans a large amount of the higher-value token, swaps it into the Maverick pool to shift reserves and skew getPriceInEth, then interacts with LMPVault (deposit to mint excess shares at depressed price, or withdraw more tokens at inflated price), then swaps back to repay the flash loan.
**Escalation:** Chains oracle skew into LMPVault share accounting: lower totalDebt to over-mint shares, or raise it to over-withdraw; also corrupts Stats contract calculations.
**Insight:** Any LP-token oracle that multiplies current pool reserves by external prices is spot-manipulable; check whether bin width/tick-spacing limits actually bound the reserve delta a single swap can produce before trusting the 'tolerable' argument.