# LibUbiquityPool::mintDollar/redeemDollar reliance on arbitrarily short TWAP oracle may be inefficient for preventing depeg

Ubiquity's TWAP oracle uses time since last update as duration, so a single-block manipulation can skew mint/redeem price checks and depeg uAD.

- Payout: Contest reward
- Severity: medium
- Program: Ubiquity
- Credited: 0xLogos
- Disclosed: 2023-12-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-ubiquity-judging/issues/20
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-ubiquity%3AM-3
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:oracle-manipulation

**Target:** LibTWAPOracle / LibUbiquityPool (uAD mint/redeem)
**Root cause:** LibTWAPOracle::consult uses the time elapsed since the last update as the TWAP duration, which can be as short as one block, so the returned price reflects only the latest block's reserves.
**Steps:**
1. Observe that `LibTWAPOracle::consult` calls `get_twap_balances` with `blockTimestamp - ts.pricesBlockTimestampLast` as duration.
2. Attacker controls two successive blocks: in block N+1, manipulate metapool reserves (e.g., 1500/500) and call `update` to record cumulative prices.
3. In block N+2, `consult` computes TWAP over 12 seconds, returning the manipulated reserves [1500, 500].
4. Mint or redeem uAD at the skewed price, or cause mint/redeem to revert by pushing price outside allowed bounds.
**How found:** Code review of LibTWAPOracle::consult revealed that the TWAP duration is derived from the time since last update, which can be arbitrarily short, allowing single-block manipulation.
**Exploitation:** A user who can control two consecutive blocks can set the TWAP to an arbitrary state for the next block, enabling them to unblock minting/burning and depeg uAD further, or DoS minting/burning.
**Insight:** When auditing TWAP oracles, check whether the observation window is fixed or derived from mutable state; a window based on time since last update can collapse to a single block, defeating manipulation resistance.