# Spot price oracle manipulation

Instant AMM price (slot0/reserves) valuing assets, shares, fees or settlement without TWAP or deviation bound

_Area: DeFi oracles, liquidations and flash loans. Seen in 118 disclosed reports; 2 confirmed bounties: $4,000 and $90,000; latest 2026-10-15. Updated 2026-10-23._

## How it works
A contract reads an AMM's instantaneous price (Uniswap slot0 sqrtPriceX96, pool reserves, same-block fills) and treats it as fair value for collateral, shares, fees, or settlement. That price is set by whoever last traded, so an attacker who can trade in the same transaction (often with flash-loaned capital) chooses the price the contract sees. The broken assumption is that spot price reflects fair value; it only reflects the last swap. The manipulable source is not always a plain slot0 read: a customized pair's own pricing/swap formula, or a token helper that auto-swaps/auto-adds liquidity, can be the thing that is skewed. Related shapes: a guard asserting spot equals a cached value, which an attacker breaks by moving the price (a DoS, not theft); a price latched at settle time and reused later, where the latch itself is the manipulation; and a rate or ratio derived from transient pool balances that a flash loan inflates.

## Where it shows up
- slot0/sqrtPriceX96 or reserve reads feeding mint, burn, borrow, deposit, liquidation, or settlement math.
- A customized pair's internal pricing/swap formula used as the value source.
- Liquidity add/remove or upgrade functions that skew the pool ratio before a value read.
- A swap function's own pricing logic looped repeatedly as the extraction step.
- Token helpers (auto-add-LP, auto-swap) performing swaps at manipulable spot prices.
- Fee or reward conversion done at receipt time rather than at a fixed or TWAP price.
- Slippage checks (amountMin) derived from the same spot read they protect.
- Aggregators averaging a manipulable spot feed with Chainlink/TWAP.
- TWAP/deviation guards covering only privileged paths (rebalance) but not permissionless mint/burn.
- Same-block guards keyed on tx.origin or msg.sender (a bypass enabler, not the root cause).
- Permissionless settle/close functions reading the same pool's live price.
- A settled price stored and later divided into a mint/claim amount.
- A derived initial rate set from a pool that can be pre-seeded before initialization.

## How to review
The invariant: any price that moves value must come from a source an attacker cannot set within the transaction that consumes it. A safe pattern is a time-weighted price plus a hard deviation cap against an independent reference (Chainlink or a stored value), applied on every value-moving path. Check each path for that guard and confirm it covers that path, not just rebalance. Verify slippage limits come from an independent reference, not the manipulated quote. For same-block guards, confirm they key on the pool or block, not caller identity. For settlement, confirm the function is gated or priced off a bounded source. For latched prices, confirm the settle path is access-controlled and the stored value is bounded at write time, not just compared at read time. For equality assertions, confirm the pool cannot be empty or skewed at check time. For derived rates, confirm the input balances cannot be inflated by a single flash loan. For custom pair formulas and token helpers, confirm the swap price they use is bounded, not the live ratio.

## Variants seen
- Empty-pool price asserted equal to a cached value, DoSing launch [E1](https://bugbountylibrary.com/r/c4%3A2024-06-vultisig%3AH-03.md).
- Hook converting pending fees at spot, sandwichable [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-17.md).
- Ungated accept() settling expired windows at spot, flash-loan drain [E3](https://bugbountylibrary.com/r/dhl%3A20261015-kolanhook.md).
- Spot collateral valuation with tx.origin same-block guard bypassed via rotated EOAs [E4](https://bugbountylibrary.com/r/dhl%3A20260912-spiralhookv2.md).
- Aggregator averaging a manipulable spot feed with Chainlink to trigger unfair liquidations [E5](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AH-03.md).
- Single slot0 read with circular slippage check [E6](https://bugbountylibrary.com/r/dhl%3A20260909-beatxswap.md).
- Guard covering only rebalance, leaving mint/burn exposed [E7](https://bugbountylibrary.com/r/dhl%3A20260823-arrakisguni.md).
- tx.origin-gated settle() latching a crashed price, then claim() over-mints [E8](https://bugbountylibrary.com/r/dhl%3A20260802-moke.md).

## Why fixes fail
Guards covering one path (rebalance) leave permissionless mint/burn reading spot [E7](https://bugbountylibrary.com/r/dhl%3A20260823-arrakisguni.md). Slippage checks computed from the manipulated quote are circular [E6](https://bugbountylibrary.com/r/dhl%3A20260909-beatxswap.md). tx.origin-keyed guards are bypassed by routing through shared contracts [E4](https://bugbountylibrary.com/r/dhl%3A20260912-spiralhookv2.md) or by any EOA latching a crashed price [E8](https://bugbountylibrary.com/r/dhl%3A20260802-moke.md). A post-settle deviation check that compares against the just-settled price is circular, not a bound [E8](https://bugbountylibrary.com/r/dhl%3A20260802-moke.md).

## Impact and severity
Drains of escrowed funds and reserves (2.31 ETH [E3](https://bugbountylibrary.com/r/dhl%3A20261015-kolanhook.md), ~10.7 ETH [E4](https://bugbountylibrary.com/r/dhl%3A20260912-spiralhookv2.md), ~2.98M BTX [E6](https://bugbountylibrary.com/r/dhl%3A20260909-beatxswap.md), ~2.94 ETH [E7](https://bugbountylibrary.com/r/dhl%3A20260823-arrakisguni.md), ~41.68M MOKE [E8](https://bugbountylibrary.com/r/dhl%3A20260802-moke.md)), unfair liquidations [E5](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AH-03.md), launch DoS [E1](https://bugbountylibrary.com/r/c4%3A2024-06-vultisig%3AH-03.md), and sandwich-only fee loss [E2](https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-17.md). Severity rises with permissionless entry points, flash-loanable capital, and missing deviation bounds.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-06-vultisig%3AH-03.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-08-flayer%3AH-17.md
- E3: https://bugbountylibrary.com/r/dhl%3A20261015-kolanhook.md
- E4: https://bugbountylibrary.com/r/dhl%3A20260912-spiralhookv2.md
- E5: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AH-03.md
- E6: https://bugbountylibrary.com/r/dhl%3A20260909-beatxswap.md
- E7: https://bugbountylibrary.com/r/dhl%3A20260823-arrakisguni.md
- E8: https://bugbountylibrary.com/r/dhl%3A20260802-moke.md