# Oracle skew via position or utilization

Live balance, collateral, or open-interest inputs that let one actor flip a ratio, EMA, or funding-derived price

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2023-08-01. Updated 2026-11-01._

## How it works
A price, rate, or ratio is computed from a live, manipulable quantity — a token balance, total pledged collateral, or open interest — rather than from a value that only changes with real economic activity. One actor can move that input cheaply (a small gift, a tiny loan against huge collateral, one large position held over time) and the derived value moves with it. The assumption that breaks: that the input reflects aggregate, honest market state. It reflects whoever is willing to post the cheapest distorting trade.

## Where it shows up
- Utilization or collateral ratio computed from `balanceOf` / live pool balance, then used to pick a branch (increase vs decrease) or a rate tier.
- Time-based accumulators (recovery timers, funding accrual) whose direction or magnitude depends on a live ratio.
- Interest-rate EMAs where the denominator is total collateral or total pledged value, not debt-weighted.
- Share/price oracles (`getTokenPrice`, exchange rate) fed by mark price, funding rate, or open interest.
- Any metric where one user can add a large denominator term with near-zero numerator, or vice versa.

## How to review
For each derived value, ask: what inputs can a single account change, at what cost, and how long does the effect persist? The invariant to check: the metric must be either (a) debt- or activity-weighted so a near-zero-contribution actor cannot move it, or (b) sourced from a value that cannot be shifted by one position within the relevant time window. Trace every branch that reads a live balance and confirm a donation or tiny borrow cannot flip it. For time-accrued values, confirm the accrual cannot be driven by one position across epochs to a profitable level.

## How finders spotted it
- Noticed the ratio direction depended on live `balanceOf` utilization, then hypothesized a donation could flip the branch and misapply a large elapsed time [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-6.md).
- Code review of the interest-rate EMA: saw TAU used total collateral rather than debt-weighted collateralization, and that collateral is freely pledgeable via `drawDebt` [E2](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-14.md).
- Hypothesized exchange rate could be manipulated via markPrice -> getTokenPrice, then tested with a huge long and time warp to confirm funding drift [E3](https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-01.md).

## Variants seen
- Small token gift flips utilization branch, skipping recovery duration [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-6.md).
- Large collateral holder with negligible debt depresses TAU and inflates rates as griefing [E2](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-14.md).
- Large long position held for weeks skews funding rate and mark price, leaking value on withdrawals [E3](https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-01.md).

## Impact and severity
E1: attacker borrows at inflated ratio and drains funds [E1](https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-6.md). E2: sustained elevated rates drive out borrowers and lenders, killing the only pool for that pair — griefing, not direct theft [E2](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-14.md). E3: value leaks on vault withdrawals via manipulated share price [E3](https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-01.md). Impact rises with how cheaply the input moves and how long the skew persists; E2 shows denial-of-service severity even without profit.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-02-surge%3AM-6.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-14.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-01.md