# Manipulated-ratio forced liquidation

Anyone can move the price or ratio a health check reads, then trigger liquidation or settlement

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2024-09-19. Updated 2026-10-24._

## How it works
A health check (collateral ratio, share price, hedge price, resolution status) is treated as trustworthy, but the value it reads can be moved by the same actor who can call liquidation or settlement. The assumption that breaks: that the ratio or price is independent of the caller. When it is not, an attacker shifts the ratio to push a victim below threshold, or settles against a price they just moved, and the protocol pays out on a false signal.

## Where it shows up
- Periphery functions that take an identity from calldata (e.g. a `Permit.account` field) and use it as `_msgSender` without checking `msg.sender` [E1](https://bugbountylibrary.com/r/dhl%3A20230818-exactly.md)
- Share-price / `convertToAssets` ratios that depend on borrow/repay or `backupEarnings`-style state an outsider can change [E1](https://bugbountylibrary.com/r/dhl%3A20230818-exactly.md)
- Settlement or maker entrypoints whose `isValidSender()` returns true for any address, so anyone can settle directly [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-8.md)
- Hedge or pricing swaps taken from a single AMM pool that can be sandwiched [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-8.md)
- Resolution checks that OR two "resolved" signals where one is only provisional (dispute/flag window still open) [E3](https://bugbountylibrary.com/r/sherlock%3A2024-09-predict-fun%3AM-2.md)

## How to review
- For every liquidation/settlement entrypoint, ask: who can call it, and who can move the value its health check reads? If the same party can do both, it is unsafe.
- Verify caller identity comes from `msg.sender`, never from a caller-supplied field, unless a signature is verified against that account [E1](https://bugbountylibrary.com/r/dhl%3A20230818-exactly.md).
- Confirm the price/ratio source is not a single manipulable pool or borrow-driven state; check for TWAP, multi-source, or bounds [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-8.md).
- Confirm "resolved" means final: the dispute/flag window must be closed before collateral can be seized [E3](https://bugbountylibrary.com/r/sherlock%3A2024-09-predict-fun%3AM-2.md).
- Invariant: liquidation must only fire on a ratio the liquidator cannot have influenced within the same transaction or block.

## Variants seen
- Identity spoofing in a periphery contract combined with a manipulable share ratio [E1](https://bugbountylibrary.com/r/dhl%3A20230818-exactly.md)
- Unpermissioned settlement against a sandwichable AMM hedge price [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-8.md)
- Premature finality: provisional oracle answer treated as final, enabling early seizure [E3](https://bugbountylibrary.com/r/sherlock%3A2024-09-predict-fun%3AM-2.md)

## Impact and severity
E1 led to ~$7M stolen via forced liquidations. E2 risks value extraction and bad debt. E3 enables collateral seizure before the market is determined. Severity rises when the manipulated signal directly gates fund movement and no permissioning or time delay stands between the attacker and the payout.

## Why fixes fail
Evidence does not show incomplete or regressed fixes.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20230818-exactly.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-8.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-09-predict-fun%3AM-2.md