# Oracle repointed after exposure

Oracle or price source changed after a loan or position exists without an equality check

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2025-08-13. Updated 2026-10-24._

## How it works
A price source is treated as fixed once a loan or position depends on it, but the code never enforces that. The oracle address (or the parameter feeding the payout formula) stays mutable, or is resolved through a lookup that silently returns a different source than intended. Whoever can change it, or trigger the wrong resolution, changes the value the contract sees after funds are already at risk. The broken assumption: that the oracle used at agreement time is the oracle used at settlement time.

## Where it shows up
- A mutable params struct (oracle, fee, LTV) updated by an `update...` function with no equality check against the current oracle [E3](https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-03.md)
- Oracle resolved by `msg.sender` inside a registry, where the caller is a hook or periphery contract rather than the vault [E2](https://bugbountylibrary.com/r/cantina%3Agauntlet_jun2025%3A3.1.1.md)
- Payout or reward formulas that multiply an owner-controlled parameter (price) by size, with no bound on that parameter [E1](https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-06.md)
- Config lookups keyed on the immediate caller in a multi-hop call chain

## How to review
Enumerate every field that affects value transfer and confirm each is pinned for the life of the position, or that changing it requires the same authority and timing as opening a new one. For registry lookups, trace every intermediate caller: the resolved oracle must be the one belonging to the vault/position, not to a forwarding contract. For payout math, confirm the price input is bounded and cannot be set by the party who benefits from it. The invariant: the price source and all value-affecting parameters at settlement equal those at agreement.

## Variants seen
- Owner sets an inflated liquidation price, self-challenges, and the reward is computed from the fake price, draining reserves and minting [E1](https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-06.md)
- Hook calls the registry directly, so per-vault overrides are bypassed and a stale default oracle is used for risk checks [E2](https://bugbountylibrary.com/r/cantina%3Agauntlet_jun2025%3A3.1.1.md)
- Lender swaps the oracle after `LOAN_OUTSTANDING`, faking a low collateral rate to seize NFTs [E3](https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-03.md)

## Impact and severity
Critical in all three: unlimited mint and reserve drain [E1](https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-06.md), collateral seizure [E3](https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-03.md), and risk checks running on stale prices [E2](https://bugbountylibrary.com/r/cantina%3Agauntlet_jun2025%3A3.1.1.md). Severity rises when the party who can repoint the oracle also profits from the mispricing, and when the payout source is a reserve or mint rather than the counterparty.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-04-frankencoin%3AH-06.md
- E2: https://bugbountylibrary.com/r/cantina%3Agauntlet_jun2025%3A3.1.1.md
- E3: https://bugbountylibrary.com/r/c4%3A2022-04-abranft%3AH-03.md