# Malicious users could use back old values

TellorOracle.getPriceInEth accepts disputed-then-removed Tellor values, letting attackers replay an old favorable price to misprice vault NAV and withdrawals.

- Payout: Contest reward
- Severity: medium
- Program: Tokemak
- Credited: ctf_sec
- Disclosed: 2023-06-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-tokemak-judging/issues/612
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-tokemak%3AM-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:oracle-manipulation

**Target:** TellorOracle.getPriceInEth price feed integration
**Root cause:** getDataBefore returns the most recent non-disputed value; when a value is disputed it is removed and an older value resurfaces, and the contract has no monotonic timestamp guard to reject values older than the last consumed one.
**Steps:**
1. Call `getPriceInEth(token)` which does `getDataBefore(queryId, block.timestamp - 30 minutes)`.
2. Attacker submits a Tellor dispute (paying fee) against the current value, removing it.
3. getDataBefore now returns the previous, attacker-favorable value within pricingTimeout.
4. Contract decodes and uses that stale price for NAV/debt/withdrawal calculations.
**How found:** Read Tellor's official integration checklist warning against using old Tellor values after disputes, then compared it to Tokemak's getPriceInEth which lacks any lastStoredTimestamp guard.
**Exploitation:** Attacker holds large vault share position (own funds or flash loan), disputes the current Tellor value so an older favorable price resurfaces, then triggers withdrawal/rebalance/NAV-dependent operation at the manipulated price, profiting more than the dispute fee.
**Insight:** When integrating Tellor, track the last consumed timestamp per queryId and reject any returned value not strictly newer; disputes silently roll the feed back to older values, so freshness checks alone are insufficient.