# Stored trigger price used as fill price

Orders that execute at a stored trigger or fixed price instead of the current oracle/market price

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2025-07-24. Updated 2026-10-23._

## How it works
A trigger price (stop-loss, take-profit, limit, or a fixed reserve order) is meant only to decide *when* an order becomes eligible. The bug is that the same stored value is also used as the *execution* price. The assumption that breaks: the code assumes the stored trigger equals a fair market price at fill time. Once the market moves past the trigger, the order fills at a price the user (or a stale config) chose, not at the price the protocol can actually trade at. The counterparty — LPs, the reserve, the protocol — absorbs the difference.

## Where it shows up
- Close/fill functions that read a stored `slPrice`, `tpPrice`, `limitPrice`, or fixed `order()` quote and pass it straight to settlement.
- Trigger checks (`price <= slPrice`) that are not followed by a separate read of the live oracle price for the fill.
- Reserve/AMM `swap()` or `quote()` returning a hard-coded or rarely-updated fixed price.
- Order creation that validates inputs but not their size (e.g. unbounded `swapPath`), letting execution be deferred to a stale-price window.

## How to review
Trace every fill path and confirm the invariant: **the trigger value gates eligibility only; the fill price is read fresh from the oracle/market at execution time.** Check that:
- The settlement price source is the live oracle, not any user-supplied or stored field.
- Fixed quotes are refreshed or bounded against a reference price before being tradeable.
- Order inputs that affect gas or timing (path length, callback behavior) are capped so execution cannot be pushed into a stale window.

## Variants seen
- Stop-loss closes at user-specified SL price, capping downside and enabling risk-free leveraged bets at LP expense [E1](https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-10.md).
- Long `swapPath` exhausts block gas in callback; attacker reverts until a later block, filling at stale prices [E2](https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-21.md).
- Stale fixed COMP/ESS order in a reserve lets anyone buy below market and resell [E3](https://bugbountylibrary.com/r/dhl%3A20250724-emptysetreserve.md).

## Impact and severity
Direct, repeatable value extraction from LPs or protocol inventory; in E1 it enabled risk-free leveraged trading, in E3 an outright drain of reserve inventory. Severity is high because the trigger is attacker-chosen or publicly visible, and the loss scales with position size or inventory. Worse when the stale price persists (fixed orders) or when execution timing is attacker-controlled (E2).

## Why fixes fail
No fix evidence in the provided reports.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-12-tigris%3AH-10.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AH-21.md
- E3: https://bugbountylibrary.com/r/dhl%3A20250724-emptysetreserve.md