# Oracle value misused as price

Oracle returns cumulative, reserve, or total value where a per-share or average price is required

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2024-10-31. Updated 2026-10-23._

## How it works
An oracle adapter consumes a value that is not a price and treats it as one. The assumption that breaks: that a helper's output is already normalized and manipulation-resistant. Three shapes appear: a pool's virtual price read as a spot price [E1](https://bugbountylibrary.com/r/sherlock%3A2022-12-sentiment%3AH-1.md), a cumulative sum read as a TWAP [E2](https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AM-14.md), and a position's total reserve value read as a per-share price [E3](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AH-4.md). In each case the number is real but the wrong quantity, so downstream logic (liquidation, order matching, swaps) acts on a value that is either manipulable or dimensionally wrong.

## Where it shows up
- Oracle reads Curve `get_virtual_price` or similar pool-internal value directly [E1](https://bugbountylibrary.com/r/sherlock%3A2022-12-sentiment%3AH-1.md)
- Adapter calls a third-party "TWAP" helper without checking it returns a UQ112x112 average and syncs the pair [E2](https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AM-14.md)
- Price feed returns aggregate position value without dividing by total supply [E3](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AH-4.md)
- Pool functions that transfer assets before updating internal balances, exposing a depressed value inside a callback [E1](https://bugbountylibrary.com/r/sherlock%3A2022-12-sentiment%3AH-1.md)
- Cumulative-sum functions (reserve0CumulativeLast + price*elapsed) consumed as a price [E2](https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AM-14.md)

## How to review
For each feed, confirm the returned value is the exact quantity the consumer expects: per-share (divide by total supply), time-weighted average (synced, UQ112x112), and not a manipulable spot or virtual value. Check that any pool-derived price cannot be moved by add/remove_liquidity within one transaction, including via reentrancy callbacks. The invariant: the oracle output must equal the intended price dimension and must not change materially from a single-transaction liquidity action.

## Variants seen
- Virtual price from Curve LP pool, manipulable via remove_liquidity and view-only reentrancy [E1](https://bugbountylibrary.com/r/sherlock%3A2022-12-sentiment%3AH-1.md)
- Cumulative reserve+price sum misused as TWAP, unsynced with pair [E2](https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AM-14.md)
- Total reserve value returned instead of per-share price [E3](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AH-4.md)

## Impact and severity
Led to unfair liquidations (~43-90% price suppression) [E1](https://bugbountylibrary.com/r/sherlock%3A2022-12-sentiment%3AH-1.md), wildly wrong prices disrupting lend/borrow matching [E2](https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AM-14.md), and mispricing risking protocol losses in swaps [E3](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AH-4.md). Severity is high where the mispriced value drives liquidation or settlement; worse when the manipulation is achievable atomically or via reentrancy.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2022-12-sentiment%3AH-1.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-10-debita%3AM-14.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AH-4.md