# Oracle adapter interface and route mismatch

Adapters calling pool methods or asset routes the target does not implement, or reusing the wrong asset across hops

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2025-02-17. Updated 2026-10-24._

## How it works
An oracle layer assumes something about the thing it calls that is not true. Either the adapter calls methods the target pool does not expose, or a routing loop assumes each hop consumes the previous hop's output when it actually reuses the original input, or a resolve/fill function trusts a caller-supplied asset/price without binding it to the stored order. In each case the interface contract between caller and callee is mismatched, so the returned price is wrong or the call reverts.

## Where it shows up
- Adapter or relayer importing a Uniswap V3 periphery library (slot0/observations/observe) against a "V3-compatible" fork.
- Multi-hop price routing loops that pass the original `asset` into recursive calls instead of the running `quotingToken`.
- Resolve/fill functions taking an asset or market identifier as a parameter without comparing it to the stored order.
- Signature validation that binds (asset, price) but never checks the asset matches the queued trade.
- Any "compatible" fork where pool ABI method names differ from the library's hardcoded calls.

## How to review
- For every adapter, diff the target pool's actual ABI against the methods the library calls. Confirm each method exists with the same name and semantics.
- In routing loops, trace a 3+ hop route with distinct intermediate oracles: each hop must consume the previous hop's output token, not the original asset.
- In resolve/fill paths, verify the supplied asset/market is cross-referenced against the stored order before pricing. A valid signature over (asset, price) is not proof the asset matches.
- Invariant: the price used to settle must be derived from the same asset pair the order was created for, through a call path the target actually implements.

## Variants seen
- Multi-hop route reuses original asset instead of intermediate quotingToken, returning wrong chained prices [E1](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-03.md).
- Resolve function never checks supplied asset equals queued trade's asset, opening options at another asset's price [E2](https://bugbountylibrary.com/r/sherlock%3A2022-11-buffer%3AH-1.md).
- Relayer calls Uniswap V3 OracleLibrary methods a Camelot pool does not implement, so all price reads revert [E3](https://bugbountylibrary.com/r/c4%3A2023-10-opendollar%3AM-14.md).

## Impact and severity
Wrong prices for chained conversions [E1](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-03.md), options opened at another asset's price draining LPs [E2](https://bugbountylibrary.com/r/sherlock%3A2022-11-buffer%3AH-1.md), and total price-read failure reverting the relayer [E3](https://bugbountylibrary.com/r/c4%3A2023-10-opendollar%3AM-14.md). Severity rises when the mismatch is silent (wrong value) rather than loud (revert), and when it feeds liquidation or settlement logic.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-03.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2022-11-buffer%3AH-1.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-10-opendollar%3AM-14.md