Skip to content
critical Oracle / Price No SWC entry CWE-345

Spot-Price Oracle Manipulation

SAFE-0022 Oracle / Price Checked automatically by the scanner
1

What goes wrong

The protocol reads price from an AMM spot reserve ratio at call time. An attacker uses a large swap (often flash-loan-funded) to move the spot price within the same transaction, then borrows, liquidates, or redeems at the manipulated price.

2

How to fix it

the pattern that is safe
// Use a manipulation-resistant source: Chainlink feed or Uniswap V3 TWAP
function price() public view returns (uint256){
    (, int256 p,,uint256 updatedAt,) = feed.latestRoundData();
    require(p > 0 && block.timestamp - updatedAt < MAX_DELAY, "stale");
    return uint256(p);
}
Mango, Cheese Bank, bZx. Never value off raw spot reserves.
3

Where this has happened

Incidents this entry cites by name:

Largest recorded losses in the same failure class — related, not the same bug:

Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0022 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs