# Funding Fee Rate is calculated based only on the Oracle Maker's skew but applied across the entire market, which enables an attacker to generate an extreme funding rate for a low cost and leverage that to their benefit

Funding rate computed only from Oracle Maker skew lets an attacker spike it cheaply, then profit via an offsetting SpotHedge short.

- Payout: Contest reward
- Severity: high
- Program: Perpetual
- Credited: IllIllI
- Disclosed: 2024-02-19
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2024-02-perpetual-judging/issues/133
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** FundingFee.getCurrentFundingRate / OracleMaker skew
**Root cause:** Funding rate is derived solely from the Oracle Maker's position skew (basePool) but charged to all market positions, so a counter-position on the SpotHedge maker gains the fee without affecting the rate.
**Steps:**
1. Deposit margin for exploiter and seed Oracle Maker ($2M) and SpotHedge maker (2000 base).
2. Open max long on Oracle Maker via `clearingHouse.openPosition` (isBaseToQuote=false, amount 1000e18) to skew it.
3. Open offsetting short on SpotHedge maker (isBaseToQuote=true, amount 2000e18); funding rate becomes extreme negative (~-3.88e17).
4. `vm.warp` to next block; close the short on SpotHedge maker to realize funding fee gains.
5. Withdraw all margin; profit ~$1.1M on $5M capital.
**How found:** Code reading of getCurrentFundingRate showing basePool cast to OracleMaker and only its settled margin used, contrasted with Vault::settlePosition applying the fee to all positions; recognized the asymmetry between where skew is measured and where fee is charged.
**Exploitation:** Attacker skews Oracle Maker with a large long, hedges with a short on SpotHedge maker in the same block so the extreme funding rate persists, then closes the short next block to collect funding fees paid by longs, and can liquidate newly-underwater positions for extra profit.
**Escalation:** Combined with liquidating positions made liquidatable by the extreme rate, and/or depositing to Oracle Maker to capture inflated share value next block.
**Insight:** When a rate/fee is computed from one pool's state but charged market-wide, check whether a hedged counter-position on a different maker can capture the fee without moving the measured state; test with the team's own test config values.