# Spot utilization rate manipulation

Rates or prices from instantaneous utilization, skew, or pool ratio with no time-weighting or slippage bound

_Area: DeFi oracles, liquidations and flash loans. Seen in 12 disclosed reports; latest 2025-08-11. Updated 2026-10-23._

## How it works
A rate, fee, or price is derived from a ratio of live pool state (utilization, skew, exchange rate) read at a single instant. The assumption that this ratio reflects sustained conditions breaks because one actor can move the numerator or denominator within a single block, act on the resulting rate, then unwind. No time-weighting or delay means the manipulated value is the value used.

## Where it shows up
- Interest/funding rate from spot utilization or one pool's skew, charged market-wide [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AH-2.md)[E4](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-8.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-2.md)
- A shared utilization metric feeding a pricing curve across asymmetric instruments [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-smilee-finance%3AH-2.md)
- Rate depends on total supply, but checkpoints written only on some mutation paths [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-15.md)
- Fee or accounting computed from an AMM swap return value rather than oracle price [E6](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.1.md)
- Migration/mint at live exchangeRate with no slippage bound [E7](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-14.md)
- Redemption fallback pricing via spot utilization [E8](https://bugbountylibrary.com/r/sherlock%3A2023-12-notional-update-5%3AM-6.md)

## How to review
Identify every rate/price input and ask: can one actor move it and reverse in the same block? The invariant: any value that gates value transfer must be time-weighted, delayed, or bounded by slippage, and must not be movable by a same-block deposit/borrow/swap. Check that averaged and instantaneous terms are not mixed [E5](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-2.md); that a rate computed from one pool is not charged to positions that can hedge elsewhere [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AH-2.md); that every path mutating a global the rate depends on writes a checkpoint [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-15.md); and that fee bases use oracle prices, not caller-controlled swap outputs [E6](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.1.md).

## Variants seen
- Cheap-side trade inflates shared utilization, repricing expensive side [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-smilee-finance%3AH-2.md)
- Skew from one maker sets market-wide funding, captured by hedged counter-position [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AH-2.md)
- Missing checkpoints on deposit/redeem/swap hooks [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-15.md)
- Same-block deposit lowers utilization before borrow [E4](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-8.md)
- Whale repayment drops instantaneous debt term [E5](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-2.md)
- Sandwich inflates swap output, shrinking fee base [E6](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.1.md)
- Large borrow skews exchangeRate at migration [E7](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-14.md)
- Spot-utilization fallback in redemption [E8](https://bugbountylibrary.com/r/sherlock%3A2023-12-notional-update-5%3AM-6.md)

## Impact and severity
Vault drain [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-smilee-finance%3AH-2.md), fee capture [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AH-2.md), forced overpayment or liquidation [E3](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-15.md), rate discounts [E4](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-8.md)[E5](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-2.md), reduced fees [E6](https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.1.md), unfair migration [E7](https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-14.md). Severity rises with pool liquidity depth and absence of slippage bounds; low-liquidity pools make manipulation cheap.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-02-smilee-finance%3AH-2.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AH-2.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-15.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-8.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-2.md
- E6: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.2.1.md
- E7: https://bugbountylibrary.com/r/c4%3A2023-04-rubicon%3AH-14.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2023-12-notional-update-5%3AM-6.md