# Oracle aggregation skew and vote dedup

Mean used where median intended, duplicate votes summed, totals out of sync with components

_Area: DeFi oracles, liquidations and flash loans. Seen in 4 disclosed reports; latest 2025-04-10. Updated 2026-10-23._

## How it works
Aggregation assumes each input has bounded influence and each signer counts once. Two breaks recur. First, a non-robust statistic: an arithmetic mean moves with any extreme value, so one reporter drags consensus and the outlier bounds derived from it [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AM-9.md). Second, identity: quorum math assumes one vote per signer, so repeated entries let one party reach threshold alone [E2](https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-01.md). A third shape is timing: a running total updated before its components are synced no longer equals their sum, so price weights are wrong until the next sync [E3](https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-11.md). Related: weighting by trade count instead of volume lets dust trades dominate an average [E4](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-01.md).

## Where it shows up
- Outlier/deviation filters computing mean and standard deviation over submitted values.
- Doc comments naming median or "robust" while code divides a sum by count [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AM-9.md).
- Vote/quorum loops adding power per array entry with no seen-signer set [E2](https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-01.md).
- Running totals (liquidity weight, stake) incremented at add-time while per-item values update at sync-time [E3](https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-11.md).
- Averages whose denominator is a fixed increment rather than fillAmount [E4](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-01.md).

## How to review
For each aggregation ask: can one input change the result? The invariant is that the consensus statistic has bounded per-reporter influence (median, trimmed mean, capped contribution) and outlier bounds are computed from that same robust statistic. For quorum, the invariant is sum of distinct signer power >= threshold, each signer counted exactly once; confirm a dedup structure exists before accumulation. For totals, the invariant is total == sum(components) at every read; check add and sync paths update both sides atomically, or reads recompute from components. Diff doc comments against code.

## Variants seen
- Mean used where median was intended in outlier detection, letting one node exclude honest reveals [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AM-9.md).
- Duplicate validator votes summed without dedup, forging 2/3+ quorum from one signer [E2](https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-01.md).
- Running liquidity total incremented at pair-add before per-pair sync, skewing TWAP price [E3](https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-11.md).
- Trade-count averaging lets dust trades dominate funding/fair price [E4](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-01.md).

## Why fixes fail
E1's comment already specified median, so intent was documented but not implemented; reviews trusting comments miss it. E3 shows partial updates: the total moved but the sync did not, so a fix touching one path leaves the mismatch.

## Impact and severity
Consensus or price manipulation by a single participant: honest reports excluded [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AM-9.md), unilateral oracle update [E2](https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-01.md), skewed VADER/USDV pricing [E3](https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-11.md), wrong funding [E4](https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-01.md). High where the skewed value feeds liquidations or pricing; worse when no special privilege is needed, only one submission or repeated entry.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-12-seda-protocol%3AM-9.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-01-initia-rollup-modules%3AM-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-11.md
- E4: https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-01.md