# Oracle version desync in settlement

Global and local state settling against different oracle versions or timestamps, skewing PnL and limits

_Area: DeFi oracles, liquidations and flash loans. Seen in 15 disclosed reports; latest 2026-02-02. Updated 2026-10-22._

## How it works
Settlement assumes every consumer of an oracle resolves the same version and timestamp for the same event. When one path keys state by a rounded or future timestamp while another records `block.timestamp`, or when global and local positions take different branches on an invalid version, the two sides accumulate PnL over different position states. The invariant that breaks: all state derived from one oracle event must settle against one identical version/timestamp.

## Where it shows up
- Settlement timestamps derived from `oracle.status()` (rounded up) compared against `oracle.request()` storing `block.timestamp` [E1](https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AH-1.md)
- Invalid-version branches that re-anchor pending positions differently for global vs local state [E2](https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AH-2.md)
- Internal mappings keyed only by an external per-provider counter (sequence/round id) [E3](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-06.md)
- Invalidation paths that bypass position limit checks [E4](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-3.md)
- Helper contracts reading `oracle.latest()` without a validity check while core falls back [E5](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-8.md)[E8](https://bugbountylibrary.com/r/sherlock%3A2023-09-perennial%3AM-5.md)
- Arithmetic like `roundId - 1` or `latestRoundId - i` on packed Chainlink roundIds [E6](https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.7.md)[E7](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-02.md)

## How to review
For each oracle event, trace every place a version or timestamp is stored, compared, or used as a key, and confirm they are identical across global and local paths. Check that invalid-version handling applies the same re-anchoring on both sides. Confirm external counters are namespaced by provider address. Diff helper contracts against core settlement branch by branch, especially the invalid-oracle branch. Verify limit checks run on invalidation paths too.

## Variants seen
- Timestamp granularity mismatch invalidating most updates [E1](https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AH-1.md)
- Global/local desync on invalid versions inflating collateral beyond deposits [E2](https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AH-2.md)
- Provider-swap collision on sequence-keyed pending requests [E3](https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-06.md)
- Invalidation exceeding makerLimit, bricking updates [E4](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-3.md)
- Helper returning zero price on invalid version, zeroing liquidation fees [E5](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-8.md)
- roundId-1 assumption breaking after aggregator upgrade [E6](https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.7.md)
- Phase/round packing causing reverts or stale prices [E7](https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-02.md)
- Helper mis-settling invalid versions, reverting liquidations [E8](https://bugbountylibrary.com/r/sherlock%3A2023-09-perennial%3AM-5.md)

## Impact and severity
Broken accounting, protocol insolvency (collateral exceeding funds), bricked markets, DoS on liquidations, and mispriced outcomes. Severity rises when the desync is silent and persists across many positions, or when it blocks liquidations entirely.

## Why fixes fail
Helper contracts lag core fixes, so the invalid-version branch diverges and reintroduces the bug [E5](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-8.md)[E8](https://bugbountylibrary.com/r/sherlock%3A2023-09-perennial%3AM-5.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AH-1.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AH-2.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-11-megapot%3AM-06.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-3.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-8.md
- E6: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.2.7.md
- E7: https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-02.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2023-09-perennial%3AM-5.md