# LibTWAPOracle::update Providing large liquidity will manipulate TWAP, DOSing redeem of uADs

Ubiquity's TWAP oracle averages pool balances not prices, so a two-block imbalanced liquidity add/remove skews uAD price and blocks redeems.

- Payout: Contest reward
- Severity: medium
- Program: Ubiquity
- Credited: GatewayGuardians
- Disclosed: 2023-12-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-ubiquity-judging/issues/56
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-ubiquity%3AM-4
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:dos vuln:oracle-manipulation

**Target:** LibTWAPOracle / Curve metapool TWAP used by UbiquityPool
**Root cause:** LibTWAPOracle::update uses IMetapool::get_twap_balances, which time-weights pool reserves (balances) rather than spot prices, so a large imbalanced liquidity provision in one block gets weighted across the window.
**Steps:**
1. Pool balanced at 10 uAD / 10 3CRV; redeems accepted.
2. Block N: attacker calls update on metapool and UbiquityPool TWAP, then adds 100 uAD + 200 3CRV (reserves 110/210).
3. Block N+1: attacker removes liquidity restoring 10/10 but does not update UbiquityPool.
4. Block N+40: attacker calls update on both oracles; cumulative reserves compute uAD=6120, 3CRV=7320, still imbalanced.
5. getDollarPriceUsd exceeds redeemPriceThreshold, so redeem reverts (DoS).
**How found:** Code reading of LibTWAPOracle::update and IMetapool::get_twap_balances revealed the oracle averages reserves over time rather than prices, prompting the two-block imbalanced-liquidity scenario.
**Exploitation:** Attacker with capital ~15x pool reserves and control of two consecutive blocks adds imbalanced liquidity in block N and removes in N+1, leaving skewed cumulative balances that keep the computed uAD price above the redeem threshold for many blocks, blocking all uAD redemptions.
**Escalation:** Duration of DoS can be extended by using more capital; judges noted potential value extraction similar to related issues.
**Insight:** When auditing a 'TWAP' oracle, check whether it time-weights reserves/balances instead of prices; balance-based averaging lets a single imbalanced liquidity add/remove in two blocks dominate the window far longer than a spot-price TWAP would.