# Exchange rate manipulation via rounding and reserves

Rate formulas where rounding, reserves, or stale prices let one transaction move share value

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2024-05-10. Updated 2026-10-30._

## How it works
A protocol treats an exchange rate as stable or monotonic and prices collateral, redemptions, or share value off it. The assumption breaks when a redeem path, a rounding direction, or an accounting field moves that rate within one transaction. The attacker positions before the move and exits after, or trips a check that reads the moved rate.

## Where it shows up
- Share/rate formulas that subtract a mutable field (reserves, fees, withdrawn amounts) from the numerator [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-dodo%3AH-1.md)
- Redeem-by-amount paths that truncate tokens burned in the user's favor [E1](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AH-01.md)
- Collateral-disable or health checks comparing current vs previous price [E1](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AH-01.md)
- Instant redemption against a buffer priced at a stale adapter rate [E2](https://bugbountylibrary.com/r/sherlock%3A2024-05-napier-update%3AH-2.md)
- Underlying assets whose value changes via rebase or slashing [E2](https://bugbountylibrary.com/r/sherlock%3A2024-05-napier-update%3AH-2.md)

## How to review
Identify every rate used for pricing and ask what can change it inside one transaction. The invariant: no action may move the rate used to value shares or collateral without a corresponding change in real assets. This covers user-triggerable moves (rounding, redeem paths) and owner actions that alter accounting fields [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-dodo%3AH-1.md). Check rounding direction on mint/redeem-by-amount; confirm owner actions that change the rate cannot be sandwiched; confirm instant-redemption paths cannot pay out before pending rebases or losses are reflected.

## Variants seen
- Rounding in redeem path nudges rate down, tripping a monotonic-price assumption [E1](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AH-01.md)
- Stale adapter rate lets users frontrun a price drop [E2](https://bugbountylibrary.com/r/sherlock%3A2024-05-napier-update%3AH-2.md)
- Owner reserve withdrawal mechanically raises exchange rate [E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-dodo%3AH-1.md)

## Impact and severity
Collateral disabled, losses shifted to honest stakers, and profit extracted at other users' expense [E1](https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AH-01.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2024-05-napier-update%3AH-2.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2023-06-dodo%3AH-1.md). Severity is high where the rate move is cheap, atomic, or mempool-visible; worse when the moved rate gates a safety check or a payout.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-01-reserve%3AH-01.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-05-napier-update%3AH-2.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-06-dodo%3AH-1.md