# Permissionless price and truth feeds

Who can write the price or truth the protocol consumes, and is the event independently validated?

_Area: DeFi oracles, liquidations and flash loans. Seen in 7 disclosed reports; one confirmed bounty: $50,000; latest 2026-09-07. Updated 2026-10-23._

## How it works
A protocol consumes a value as authoritative price or truth, but the path that sets that value is open to anyone, or the consumer never re-derives it from an independent source. The assumption that breaks is "only a trusted party can move this feed, and the value reflects a real event." When the setter is permissionless, an attacker can momentarily set an arbitrary price or get an unchallenged answer accepted, and the consuming logic (borrow, liquidate, claim, payout) acts on it. The invariant: the consumed value must be writable only by a trusted party, or the consumer must re-derive it from an independent source (a real mint, balance delta, or validated event).

## Where it shows up
- Trigger accepts a proposal when `proposedPrice == AFFIRMATIVE` without verifying the underlying event [E1](https://bugbountylibrary.com/r/dhl%3A20260907-cozyfinance.md)
- Lending logic reads a permissionless oracle's last-reported value as spot price; reporter timelock is per-address, so fresh addresses reset the clock [E3](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-bonqdao-february-2023.md)
- Message handler credits from parsed byte offsets without a real mint or balance delta [E2](https://bugbountylibrary.com/r/dhl%3A20260819-allbridgecctp.md)
- Borrower supplies the oracle the lender later trusts for liquidation [E5](https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-01.md)
- Hardcoded peg (USDC/sUSD = $1) used as collateral price [E6](https://bugbountylibrary.com/r/sherlock%3A2022-11-isomorph%3AM-6.md)
- Signature check reads a registry entry that returns zero for unknown keys, so an unregistered key signs the feed [E4](https://bugbountylibrary.com/r/c4%3A2025-03-starknet-perpetual%3AH-01.md)
- Balancer-style callback that mutates oracle state lacks the `onlyVault` guard its sibling callbacks have [E7](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sense-finance-access-control-issue-bugfix-review.md)
- Permissionless pool creation lets the first LP set the initial price, then mint synth against it [E8](https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-12.md)

## How to review
Check who can write the feed. Is the timelock global or per-address? Does the trigger verify the event rather than trusting an unchallenged proposal? Is eligibility snapshotted before the proposal [E1](https://bugbountylibrary.com/r/dhl%3A20260907-cozyfinance.md)? For bridges, require an actual token mint or balance delta, not just a parsed message hash [E2](https://bugbountylibrary.com/r/dhl%3A20260819-allbridgecctp.md). For lending, confirm the oracle is fixed by the lender, not supplied by the borrower [E5](https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-01.md), and that no leg is a constant peg [E6](https://bugbountylibrary.com/r/sherlock%3A2022-11-isomorph%3AM-6.md). For signature-gated feeds, assert the registry entry is non-zero before trusting it [E4](https://bugbountylibrary.com/r/c4%3A2025-03-starknet-perpetual%3AH-01.md). Enumerate every callback that writes oracle or reserve state and diff its access modifiers [E7](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sense-finance-access-control-issue-bugfix-review.md). For pool creation, check whether initial pricing is permissionless and whether mint can run before liquidity exists [E8](https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-12.md). Confirm the manipulation window is atomic: can the attacker set the value and consume it in one transaction, with no independent re-derivation in between? Note that some variants are persistent config, not momentary: a borrower-chosen oracle [E5](https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-01.md) stays wrong across many transactions.

## Variants seen
- Permissionless optimistic oracle accepts fraudulent proposal [E1](https://bugbountylibrary.com/r/dhl%3A20260907-cozyfinance.md)
- Forged bridge message credits phantom deposit [E2](https://bugbountylibrary.com/r/dhl%3A20260819-allbridgecctp.md)
- Permissionless TellorFlex spot feed swung up then down [E3](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-bonqdao-february-2023.md)
- Unregistered signer passes zero-value registry read [E4](https://bugbountylibrary.com/r/c4%3A2025-03-starknet-perpetual%3AH-01.md)
- Borrower-chosen oracle blocks liquidation [E5](https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-01.md)
- Hardcoded stablecoin peg misprices collateral [E6](https://bugbountylibrary.com/r/sherlock%3A2022-11-isomorph%3AM-6.md)
- Unguarded swap callback writes oracle price [E7](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sense-finance-access-control-issue-bugfix-review.md)
- Attacker-priced pool mints cheap synth [E8](https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-12.md)

## Impact and severity
Drains ranged from ~$160K to ~$1M; one event borrowed 100M BEUR and liquidated 30+ troves for ~113M WALBT [E3](https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-bonqdao-february-2023.md). Severity is high because manipulation and profit happen atomically; flash loans remove capital requirements. Worse when the payout source is a reserve or unlimited mint [E1](https://bugbountylibrary.com/r/dhl%3A20260907-cozyfinance.md).

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260907-cozyfinance.md
- E2: https://bugbountylibrary.com/r/dhl%3A20260819-allbridgecctp.md
- E3: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-hack-analysis-bonqdao-february-2023.md
- E4: https://bugbountylibrary.com/r/c4%3A2025-03-starknet-perpetual%3AH-01.md
- E5: https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-01.md
- E6: https://bugbountylibrary.com/r/sherlock%3A2022-11-isomorph%3AM-6.md
- E7: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-sense-finance-access-control-issue-bugfix-review.md
- E8: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-12.md