# Oracle average skewed by unweighted trades

Averaging or EMA inputs where tiny orders, unweighted trades, or poke lock a manipulable price

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2026-03-09. Updated 2026-11-02._

## How it works
An oracle that averages or smooths prices is only as strong as its weighting and its time window. Three assumptions break: (1) that a deviation cap limits how far price can move, when the cap is applied per update rather than per unit of time; (2) that a time-bucketed update is safe, when the first caller in each bucket controls the value; (3) that averaging many trades smooths manipulation, when each trade counts equally regardless of size. In each case a cheap, repeatable action (repeated updates, a permissionless poke, dust orders) shifts the stored price far more than the design intended.

## Where it shows up
- Deviation checks comparing a new value only to the last stored value, with no elapsed-time term [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-22.md).
- Update functions callable repeatedly in sequence, so a per-step cap can be ratcheted [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-22.md).
- Oracle updates gated on a coarse epoch/bucket rather than elapsed time, where the first caller wins [E2](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-11.md).
- Permissionless poke/update functions reading a spot price that flash loans can move [E2](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-11.md).
- Averages that increment a count by 1 per trade instead of by fill amount [E3](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-01.md).
- Any averaging denominator that is trade count rather than volume [E3](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-01.md).

## How to review
Identify the exact invariant the smoothing is meant to enforce, then check the code enforces it:
- Deviation guard: does the limit apply over a time window (rate), or only against the previous stored value? If per-update, can the update be called repeatedly? [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-22.md)
- Epoch-gated updates: is the first write in a bucket permissionless, and does it read a manipulable spot value? [E2](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-11.md)
- Averages: is the denominator fillAmount/volume, or a fixed increment per trade? Dust trades must not move the average [E3](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-01.md)
- Confirm the input source cannot be moved within the update window by a flash loan [E2](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-11.md).

## How finders spotted it
- Read the deviation check and noticed it compares only to the last stored value with no elapsed-time component, making it per-transaction rather than rate-limited [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-22.md).
- Read the epoch-gating logic and noticed pokeOracle lacks access control and reads a manipulable spot tick [E2](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-11.md).
- Read the averaging logic and noticed each trade increments count by 1 rather than by fillAmount [E3](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-01.md).

## Variants seen
- Per-update deviation cap ratcheted by repeated setPrice calls [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-22.md).
- Epoch-locked tick via permissionless poke, cumulative across epochs [E2](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-11.md).
- Trade-count-weighted hourly average skewed by dust orders [E3](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-01.md).

## Impact and severity
Price can deviate far beyond the intended maxDeviationRate [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-22.md); oracle manipulation locks a manipulated tick for a full epoch and drifts cumulatively (149 ticks per epoch) [E2](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-11.md); funding rates and fair price are skewed [E3](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-01.md). Impact rises with repeatability and cumulative drift across windows [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-22.md)[E2](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-11.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AM-22.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-11.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-01.md