# Price calculation can be manipulated by intentionally reverting some of price feeds.

Olympus PRICE module ignores reverting feeds; attacker triggers UniV3/Balancer/Bunni reentrancy reverts to drop honest feeds and force a manipulated spot price into the median.

- Payout: Contest reward
- Severity: medium
- Program: Olympus
- Credited: KupiaSec
- Disclosed: 2023-11-30
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-11-olympus-judging/issues/127
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained vuln:oracle-manipulation vuln:reentrancy

**Target:** PRICE module price-feed aggregation (UniswapV3/Balancer/Bunni submodules)
**Root cause:** Price calculation skips feeds that revert instead of reverting the whole computation, so an attacker who can force a feed to revert (via reentrancy locks in UniV3/Balancer/Bunni) removes honest price sources from the median/average strategy.
**Steps:**
1. Identify asset configured with multiple feeds (e.g. Chainlink + UniV3 + Bunni) using median strategy.
2. Manipulate one spot feed (e.g. UniV2 reserves) to a favorable price.
3. Within the same tx, enter a UniV3 pool callback so `slot0().unlocked == false`, making UniswapV3Price revert on `UniswapV3_PoolReentrancy`.
4. Similarly trigger Balancer `ensureNotInVaultContext` or Bunni `_validateReserves` deviation revert to drop those feeds.
5. PRICE module ignores reverted feeds; median of remaining (manipulated + Chainlink) yields skewed price.
6. Buy/sell OHM at the skewed fair price for profit.
**How found:** Code reading of each price submodule revealed reentrancy/deviation guards that revert; combined with the aggregator's skip-on-revert behavior and the median strategy's 'first non-zero price when two valid' logic, the researcher hypothesized an attacker could selectively silence honest feeds.
**Exploitation:** Attacker flash-loans to skew a spot pool, then in the same transaction enters a UniV3 mint/swap callback (or Balancer vault context) so the honest oracle submodule reverts its reentrancy check; the aggregator silently drops it and computes price from the manipulated feed plus one other, extracting value via Olympus buy/sell at the wrong price.
**Escalation:** Chaining reserve manipulation with forced oracle reverts converts a single-feed manipulation into a full median-strategy bypass; PoC showed Olympus price moving from ~6.3 to ~29.5.
**Insight:** When an oracle aggregator tolerates reverting feeds, any submodule whose revert condition is attacker-triggerable (reentrancy locks, deviation checks, vault-context guards) becomes a switch to remove honest price sources; check whether guards can be tripped inside a callback to bias the median.