# Oracle.sol: manipulation via increasing Uniswap V3 pool observationCardinality

Aloe Oracle.observe reads uninitialized Uniswap V3 observation slots (timestamp 1) when given a malicious seed, corrupting TWAP/IV and enabling bad-debt or liquidation manipulation.

- Payout: Contest reward
- Severity: high
- Program: Aloe
- Credited: roguereddwarf
- Disclosed: 2023-10-11
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2023-10-aloe-judging/issues/40
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AH-2
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** Solidity Oracle library reading Uniswap V3 pool observations
**Root cause:** Oracle.observe trusts a caller-supplied seed index and does not check the observation's `initialized` flag, so uninitialized circular-array slots (blockTimestamp=1, zeroed cumulatives) are used as left/right bounds in interpolation.
**Steps:**
1. Call Uniswap V3 `Pool.increaseObservationCardinalityNext` to grow the observations array, leaving trailing slots uninitialized (timestamp=1).
2. Perform swaps so `Oracle.write` advances observationIndex and populates slots, arranging the array e.g. `[12,20,25,30,1,1,1]` with current index at 3.
3. Pass a `seed` whose lower 32 bits point to index 6 (uninitialized slot) with high 8 bits zero, forcing Aloe `Oracle.observe` to pick left=1, right=12.
4. `Oracle.observe` computes tickCumulatives/secondsPerLiquidityCumulativeX128s from the invalid element, corrupting `Oracle.consult` output.
5. Corrupted TWAP/IV flows into `VolatilityOracle.update`/`consult` and downstream liquidation/valuation logic.
**How found:** Researcher read Aloe's adapted Oracle.observe against Uniswap V3's Oracle library, noticed the seed-based index selection lacks the `initialized` check, and reasoned through the circular-array semantics to construct an array state where an uninitialized slot (timestamp 1) becomes a bound.
**Exploitation:** Attacker grows observation cardinality, uses swaps to shape the circular array so an uninitialized slot sits adjacent to a real observation, then supplies a crafted seed to Oracle.consult. The resulting inflated TWAP is used for liquidations and borrow valuation, letting the attacker liquidate accounts or take bad debt against inflated Uniswap V3 liquidity valuation.
**Escalation:** Corrupted oracle output propagates to VolatilityOracle and core protocol, enabling liquidation of accounts with borrows (per judge note, liquidation ignores seemsLegit) and bad-debt accrual.
**Insight:** When a protocol forks Uniswap V3's Oracle library, diff the fork against upstream for dropped `initialized` checks and any caller-controlled index/seed hints; uninitialized circular-buffer slots with timestamp=1 are a reliable corruption primitive if cardinality can be grown by anyone.