---
name: defi-oracles-liquidations-and-flash-loans
description: "Guides a reviewer through auditing DeFi oracle pricing, liquidation logic, and flash-loan-funded attack surfaces on an authorized target, using the pattern index as probes."
---

# DeFi oracles, liquidations and flash loans

Price feeds that can be moved or go stale, liquidation logic, and attacks funded by flash loans.

_From Bug Bounty Library (https://bugbountylibrary.com): generated from disclosed, accepted reports and updated as new ones land. Updated 2026-10-23. Tested on 43 newer reports it was not written from: following it finds about 60% of them._

## How to approach this area

Oracles, liquidations, and flash loans are one connected surface: a price the protocol trusts, a health check that decides when positions are unsafe, and a repayment path that can be funded atomically. Start by mapping the money flow, not the code.

**Map first**
1. Every price source and where its value enters: collateral valuation, share/LP pricing, borrow limits, liquidation bonus, settlement. Note feed type (AMM spot, TWAP, Chainlink, custom), decimals, base/quote orientation, and freshness rules.
2. Every health/solvency check: which function, which inputs, when it runs (borrow, withdraw, repay, liquidate, partial close).
3. Every liquidation entrypoint and its exit paths, including equality and last-item branches.
4. Every flash-loan or callback receiver and what it trusts from the caller.
5. Who can write prices, trigger refreshes, or change borrower state.

**Questions that surface weaknesses**
- Can one transaction move the price this logic reads, and is there a TWAP, deviation bound, or time-weighting that actually binds?
- Is the price fresh, correctly denominated, and oriented (multiply vs divide, min/max)?
- Can a non-privileged actor make a liquidation revert, or make the borrower's state un-liquidatable cheaply?
- Does every liquidation path recompute solvency after repay/seize/swap, using accrued interest and current totals?
- Are slippage bounds derived from the same spot price they guard?
- Can a flash loan inflate shares, utilization, votes, or averages within one block?
- Do callbacks fire before state settles, and are loan params proven self-initiated?

**Using the patterns**
Treat each pattern as a checklist probe against your map. For each price path, walk the decimal/unit and composition patterns. For each liquidation path, walk the solvency, interest, bonus-base, and edge-case patterns. For each callback, walk reentrancy and trust patterns. Flag any spot read without a bound, any health check that differs between entry and exit, and any fallback to a manipulable source. Prioritize findings where a single atomic actor controls both sides.

## Patterns

Each pattern below has a full write-up (how it works, where it shows up, how to review for it, variants, impact), grounded in
real disclosed reports. Load the one you need from its link.

### Spot price oracle manipulation
Instant AMM price (slot0/reserves) valuing assets, shares, fees or settlement without TWAP or deviation bound

_118 reports · 2 confirmed bounties: $4,000 and $90,000._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/spot-price-oracle.md

### Liquidation blocked by reverting path
Can an underwater account's liquidation call be made to revert by state a non-privileged actor controls?

_53 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-dos-revert.md

### Stale oracle price consumption
Risk logic reads a price or rate without a real freshness check, or reuses a cached snapshot after value changed

_52 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/stale-oracle-no-timestamp.md

### AMM reserve skew via burn and sync
Token code that burns or moves tokens out of the pair's own balance, then calls sync()

_39 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/reserve-manipulation-burn-sync.md

### Oracle decimal and unit mismatch
Trace decimals and quote unit from feed to final use; check ordering, chaining, and normalization

_38 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-decimal-mismatch.md

### Missing slippage bound on value-moving swaps
Value-moving swap, deposit or redemption leg with no caller-chosen min-out or price band

_34 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/slippage-zero-min-out.md

### Degenerate TWAP oracle windows
Short, retroactive or derived-input TWAPs where one trade or input sets the price

_24 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/twap-window-too-short.md

### LP share spot-price manipulation
LP value read from live reserves, slot0 or virtual price, letting one swap misprice mint, borrow or liquidation

_24 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/lp-share-spot-pricing.md

### Inverted oracle price direction
Check base/quote orientation, multiply vs divide, and min/max choice on every price path

_22 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-direction-inversion.md

### Sandwichable predictable price updates
Can an outsider see or trigger a price change and trade on both sides of it?

_22 reports · one confirmed bounty: $28,730._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/sandwich-predictable-update.md

### Caller-supplied liquidation data trusted
Liquidator picks swap path, market, oracle or repay amount the protocol then trusts

_18 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-caller-supplied-data.md

### Liquidation skips post-action solvency check
Does every liquidation exit path recompute solvency after repay/seize/swap, including partial and self-directed closes?

_16 reports · one confirmed bounty: $116,513._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-missing-solvency-recheck.md

### Liquidation ignores accrued interest
Health or debt math using stale principal or snapshot values instead of accrued interest and current totals

_16 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-accounting-interest.md

### Oracle fallback to manipulable source
Feed failure or timeout falls back to spot reserves, zero, or a constant instead of reverting

_15 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-fallback-manipulable.md

### Oracle version desync in settlement
Global and local state settling against different oracle versions or timestamps, skewing PnL and limits

_15 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-version-desync.md

### Borrower-mutable state blocks liquidation
Can a borrower cheaply reset, rotate, or shrink the state a liquidation depends on?

_14 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-griefing-dust.md

### Manipulable slippage bounds in DeFi
minOut or liquidity floor derived from the same spot price it guards, so it never binds

_14 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/slippage-from-spot-quote.md

### Donation-inflated collateral share pricing
Oracle or collateral value derived from a live token balance or exchange rate that a direct transfer can inflate

_12 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/donation-inflates-collateral.md

### Profitable self-liquidation in lending
Can one actor be borrower and liquidator, and does the bonus exceed the cost of reaching the liquidation edge?

_12 reports · one confirmed bounty: $180,000._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/self-liquidation-profit.md

### Spot utilization rate manipulation
Rates or prices from instantaneous utilization, skew, or pool ratio with no time-weighting or slippage bound

_12 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/interest-rate-utilization-manipulation.md

### Unvalidated flash-loan callback trust
Callbacks that trust caller params or initiator instead of proving the loan was self-initiated

_11 reports · one confirmed bounty: $60,000._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/flash-loan-callback-unvalidated.md

### Unrealized PnL omitted from health checks
Margin and liquidation checks that ignore pending orders, unrealized PnL, or floating accrual, or use mismatched state

_11 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/health-check-unrealized-pnl.md

### Missing L2 sequencer uptime check
L2 price feeds and time-based pricing read without sequencer uptime feed or grace period

_9 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-sequencer-uptime.md

### Oracle price composition math errors
Wrong operand, order, denomination, rounding, or double-applied fee when composing oracle prices

_9 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-math-composition-error.md

### Signed price replay and stale oracle reports
Signed price payloads accepted without strict monotonic timestamp or index-uniqueness checks, allowing replay of older observations.

_8 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-replay-signed-price.md

### Partial vs full liquidation mismatch
Liquidation paths where a cap, min-size check, or exact-equality test blocks full or partial close, leaving bad debt.

_8 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-partial-full-mismatch.md

### Missing solvency check on borrow paths
Entrypoints that raise debt or remove collateral without re-running the same post-action solvency/LTV check

_8 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/health-check-missing-borrow.md

### Read-only reentrancy in price oracles
Oracle reads pool balances and supply during callbacks without a reentrancy guard, so prices desync

_7 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/read-only-reentrancy-oracle.md

### Reentrancy in liquidation and flash actions
External callbacks (token/NFT hooks, flash receivers, routers) firing before collateral, debt or limit state is settled

_7 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/reentrancy-during-liquidation.md

### Oracle floor/cap trusted blindly
Chainlink answer used without checking it against the aggregator's minAnswer/maxAnswer band

_7 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-circuit-breaker-floor.md

### Permissionless price and truth feeds
Who can write the price or truth the protocol consumes, and is the event independently validated?

_7 reports · one confirmed bounty: $50,000._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-permissionless-feed.md

### Liquidation guard edge-case accounting skips
Equality, last-item or timestamp guards in liquidation that skip bad-debt, lien or position accounting

_7 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-accounting-skip-on-edge-case.md

### Fee-on-transfer AMM reserve desync
Tokens whose fees or hooks make pair balanceOf diverge from cached reserves, then skim/sync abuse

_6 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/fee-on-transfer-reserve-desync.md

### Wrong collateral identity in liquidation
Liquidation values or seizes a token, chain, registry or price that differs from where the collateral lives

_6 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-wrong-collateral-token.md

### Hardcoded stablecoin peg mispricing
Code assumes a stablecoin or LST equals its peg asset at 1:1 without checking market price

_6 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-hardcoded-peg-mispricing.md

### Wrong health metric in liquidation checks
Liquidation or health checks comparing the wrong ratio, variable, or sign instead of the price-adjusted metric

_6 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-health-metric-mismatch.md

### Flash-loan governance takeover
Can voting weight be acquired and used to execute a proposal in one transaction or block?

_5 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/flash-loan-governance.md

### Liquidation incentive and seizure math errors
Check liquidation math for wrong base, per-step incentive, and validated-then-mutated amounts

_5 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-incentive-math-errors.md

### Liquidation bonus base miscalculation
Check every liquidation ratio, bonus and divisor uses debt repaid or effective cap as its base

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-incentive-miscalc.md

### Intra-transaction oracle price selection
Can one tx read two prices for the same asset, or flip an oracle status branch?

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-multi-update-same-tx.md

### LTV equals liquidation threshold
Borrow cap and liquidation trigger sharing one rate, or two health checks valuing collateral differently

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-threshold-mismatch.md

### Flash-loan share and index inflation
Share price, index or reward split derived from a live balance, supply or spot rate one caller can move

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/share-inflation-flash-mint.md

### Just-in-time fee capture by flash-loan LPs
Fees settled lazily and split by current share, letting a same-block LP deposit capture accrued fees

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/flash-lp-fee-reclaim.md

### Oracle aggregation skew and vote dedup
Mean used where median intended, duplicate votes summed, totals out of sync with components

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-mean-not-median.md

### Just-in-time deposit value capture
Spot share price or reward snapshot moved by a same-block deposit, repay, or forced trigger

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/just-in-time-deposit-interest-capture.md

### Loan-inflated aggregate manipulation
Can one atomic position skew an average, TVL weight, or supplied price that a payout or liquidation reads?

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-manipulation-via-loan-inflated-average.md

### Unvalidated order parameters cause bad debt
Order ids, swap paths and trade sizes accepted without bounds or existence checks before settlement

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/unvalidated-order-params.md

### Permissionless refresh front-run
Anyone can trigger a refresh or retry that changes pricing or redemption terms before a victim's action

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/permissionless-refresh-frontrun.md

### Liquidation bonus worsens position health
Does the liquidation bonus or gas compensation push post-liquidation collateral ratio below the bad-debt threshold?

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-incentive-worsens-health.md

### Liquidation threshold metric mismatch
Liquidation math using the wrong rate, divisor, or share-vs-amount basis, so thresholds disagree

_4 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-threshold-metric-mismatch.md

### Collateral released before repayment
Liquidation or bid flows that release or leave collateral before repayment is pulled or escrowed

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-collateral-seized-before-repay.md

### Order bounds not revalidated at fill
Creation-time order bounds (size, SL/TP, trigger) not re-checked, or wrongly re-checked, against the fill price

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/stale-trigger-bounds-not-revalidated.md

### Block-derived randomness drain
Randomness from blockhash, timestamp, prevrandao or counters that a caller can predict or grind

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/block-value-randomness-drain.md

### Liquidation threshold and weight manipulation
Can a borrow, admin update, or weight change move thresholds and force healthy positions into liquidation?

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-threshold-parameter-manipulation.md

### Blocked or missing liquidation path
Can every undercollateralized position actually be liquidated, or is the path blocked, gated, or self-defeating?

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-path-missing-or-blocked.md

### Oracle value misused as price
Oracle returns cumulative, reserve, or total value where a per-share or average price is required

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-price-source-misuse.md

### Share mint price mismatch
Mint or wrap prices shares off an oracle, perp, or live rate that differs from the real execution price

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/share-mint-price-mismatch.md

### Liquidation accounting reverts block bad debt
Liquidation math that reverts, underflows, or rounds to zero, leaving bad debt or collateral mishandled

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-accounting-revert-dos.md

### Flash-loan share price manipulation
Share price or totalAssets derived from live balances, supply, or oracle paths a flash loan can reset or inflate

_3 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/flash-loan-share-price-reset.md

### Auction deadline duration timestamp confusion
Stored auction end is a duration, not block.timestamp plus duration, so guards fire early or late

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-epoch-timestamp-confusion.md

### Oracle cumulative arithmetic reverts
Checked math or sentinel max values on cumulative oracle prices that revert and brick dependent logic

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-cumulative-overflow-dos.md

### Oracle divergence threshold blocks liquidations
Feed or liquidation reverts when price deviation exceeds a threshold, freezing exits during volatility

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-divergence-threshold-dos.md

### Packed storage slot corruption in oracles
Assembly packing helpers with wrong slot offsets or missing shift masks that corrupt reserves and oracle values

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-packed-slot-corruption.md

### Stored trigger price used as fill price
Orders that execute at a stored trigger or fixed price instead of the current oracle/market price

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/stored-trigger-price-used-for-fill.md

### Oracle revert blocks later price updates
Validation reverts in price receivers or keepers that stall or cancel later legitimate updates

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-revert-blocks-updates.md

### Custom price reused as swap price
Order or custom price stored then reused as swap execution price instead of market

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/oracle-price-reused-for-swap.md

### Stale or lagging price in liquidation
Liquidation price or incentive taken from a snapshot, EMA, or average instead of the current price

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/defi-oracles-liquidations-and-flash-loans/liquidation-price-source-lag.md

## Rarer patterns

Seen only once or twice so far, so there is no full write-up yet; each links to the report that shows it.

- **Admin repoints oracle without timelock**: Privileged setter swaps price feed instantly, letting admin force liquidations or zero prices (https://bugbountylibrary.com/r/sherlock%3A2023-03-taurus%3AM-4.md)
- **Cached price served before asset enabled check**: Price cache or TTL lookup returns before checking whether the asset is enabled or disabled (https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-25.md)
- **Expired orders included in mark price**: Mark or index price averages stale or expired orders that can be placed to skew it (https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-02.md)
- **Flash loan slippage drain**: Liquidity added at oracle price with full slippage tolerance, drainable in one flash loan (https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-fei-protocol-flashloan-vulnerability-bugfix-review.md)
- **Flash-loaned balances inflate interest and rewards**: Interest or reward accrual reads instantaneous token balance movable within one transaction (https://bugbountylibrary.com/r/dhl%3A20231211-goodcompound.md)
- **Pending withdrawal valued at live price**: Queued or escrowed withdrawals priced with current yield-token oracle instead of fixed entry value (https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AM-14.md)
- **Per-update deviation cap bypassed by repeated updates**: Oracle update path caps each change but no cumulative or per-block deviation limit across multiple updates (https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-22.md)
- **Permissionless burn callable by anyone**: A burn or sync-like function anyone can call directly moves pair reserves or pricing (https://bugbountylibrary.com/r/dhl%3A20260604-bytoken.md)
- **Predictable settlement front-run**: Settlement or liquidation outcome computable in advance, letting LPs exit before losses (https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AH-02.md)
- **Ring buffer wrap reuses stale slots**: Circular observation buffer where wrap overwrites or reads unexpired stale entries (https://bugbountylibrary.com/r/cantina%3Ainstadapp_september2024%3A3.1.1.md)
- **Scaling factor applied inverted**: Collateral or price math multiplies where it should divide by tokenScale/decimals (https://bugbountylibrary.com/r/c4%3A2024-07-loopfi%3AM-11.md)
- **Stale reserve derived pricing**: Rewards, penalties, or prices read reserves or accumulators that only refresh on swap (https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-fei-protocol-vulnerability-bugfix-review.md)
- **Unauthenticated read extends oracle TTL**: Permissionless read or view helper refreshes or extends a circuit-breaker price TTL (https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-12.md)
- **Uninitialized oracle observation slots trusted**: TWAP/observation buffer read before slots written, or seeded by caller-supplied values (https://bugbountylibrary.com/r/sherlock%3A2025-02-yieldoor%3AM-4.md)
- **Wrapped asset priced via underlying**: Wrapped or staked token valued from underlying feed or 1:1 peg, ignoring depeg (https://bugbountylibrary.com/r/sherlock%3A2024-06-mellow%3AM-4.md)