# Custom price reused as swap price

Order or custom price stored then reused as swap execution price instead of market

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2024-04-10. Updated 2026-10-23._

## How it works
A pricing function is given a "custom price" override so one caller (order execution) can force a specific price. The override is stored in shared state and later read by a different consumer (a swap, a mint, a withdrawal) that assumes it is getting the market price. The assumption that breaks: that a price source is single-purpose. Once a function can return a caller-supplied or mode-dependent price, every downstream reader inherits that value, and the protocol trades or mints at a price it did not choose.

## Where it shows up
- A getLatestPrice()-style getter that returns a stored override (trigger/maximized/custom) rather than a fresh market quote.
- Swap or mint code that calls the same getter used during order execution.
- "Safe mode" or tradability flags that skip oracle checks (e.g. remove-liquidity-only).
- Mint paths pricing collateral from a derivative or AMM quote instead of a spot oracle.
- Fee formulas that clamp to 1.0 when spot and oracle diverge.

## How to review
Trace every consumer of the pricing getter. The invariant: a swap, mint, or withdrawal must price at the market/oracle value at execution time, never at a value set by an earlier order or by a mode flag. Check that custom-price overrides are scoped to the single operation that set them and cleared or bypassed before any downstream swap. For mode flags, confirm the flag cannot be toggled while price is already off-oracle, and that divergence triggers a revert, not a 100% fee.

## Variants seen
- Order's custom price reused for the post-order swap, enabling arbitrage [E1](https://bugbountylibrary.com/r/sherlock%3A2023-04-gmx%3AH-3.md).
- Remove-liquidity-only mode bypasses price check; withdrawal fee clamps to 1.0, zeroing LPs [E2](https://bugbountylibrary.com/r/c4%3A2024-02-hydradx%3AM-10.md).
- Mint prices collateral via perp quote (vUSD) not spot, breaking the peg [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-9.md).

## Why fixes fail
E2 shows a fix-shaped guard (is_safe_withdrawal) that itself treats a mode as safe and skips the oracle check; the fee clamp then silently confiscates principal. Skipping a check under a flag is not a fix.

## Impact and severity
Direct fund loss: arbitrage against the protocol [E1](https://bugbountylibrary.com/r/sherlock%3A2023-04-gmx%3AH-3.md), total loss of LP principal [E2](https://bugbountylibrary.com/r/c4%3A2024-02-hydradx%3AM-10.md), stablecoin peg destabilization [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-9.md). Severity is high because the mispricing is repeatable and the loss lands on LPs or the protocol. Worse when the bad price persists in state across operations or when a fee formula converts divergence into full confiscation.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-04-gmx%3AH-3.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-02-hydradx%3AM-10.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-9.md