Oracle infrastructure vulnerabilities in disclosed reports
Findings against the price infrastructure itself — aggregation, node operation, feed lifecycle and the guarantees consumers rely on.
- Reports indexed
- 115
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
Reports in this group target oracle systems rather than their consumers: aggregation logic, the node operator set, update cadence and the handling of feeds that are deprecated, paused or newly listed.
The recurring theme is the gap between what an oracle guarantees and what integrators assume it guarantees. Heartbeat and deviation thresholds describe the worst case, not the typical case, and a consumer that treats the typical case as guaranteed is the one that gets exploited.
Read these alongside the oracle manipulation category, which covers the consumer side of the same relationship.
What reviewers look for
- Aggregation that tolerates a small number of malicious reporters
- Feed lifecycle events — deprecation, pause, migration — unhandled by consumers
- Update cadence assumptions that do not hold under congestion
- Fallback and circuit-breaker behaviour that fails open
- Newly listed feeds with sparse reporter coverage
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Centrifuge Protocol V3.1: `SimplePriceManager.onUpdate()` lack of forward execution fee leads dependent functions to revert
Centrifuge's SimplePriceManager.onUpdate() routes share-price updates through Gateway.withBatch(), but the function is not payable and forwards no native token, so the outgoing batch runs with zero execution fuel. When the protocol is not in unpaidMode, Gateway._send() cannot satisfy fuel >= cost and reverts with NotEnoughGas. This permanently DoSes NAV and oracle price propagation for any caller using NAVManager.updateHoldingValuation() or OracleValuation.setPrice(). The fix makes onUpdate() payable and forwards msg.value to withBatch().
Super DCA Liquidity Network: Manager can retroactively apply new rate to past time, misallocating emissions - Invariant Broken
SuperDCAStaking distributes emissions to stakers through an accruing rewardIndex whose exact increment formula is contractually guaranteed by the protocol readme. The guard in setMintRate() re-assigns the emission rate without first settling rewards for the time elapsed since lastMinted. As a result the entire past interval is priced at the new rate rather than the rate that was in effect, so a rate change retroactively re-prices already-earned rewards. This lets a manager or any holder of the rate-setter role backdate a rate change, overpaying or underpaying stakers and breaking the documented invariant. The protocol acknowledged and fixed the issue in the referenced pull request.
Brevis Pico ZKVM: Malicious verifier will recover private witness values breaking zero-knowledge property
Brevis Pico, a privacy-preserving zkVM, relies on a fork of the gnark proving library (v0.1.0) that carries CVE-2024-45040: the Groth16 proving system emits Pedersen commitments without blinding factors. Because the BabyBear, KoalaBear, and verifier circuits invoke RangeChecker.Check() (which internally uses these unblinded commitments) whenever the GROTH16 environment variable is not set to 1 — the production default — a verifier who holds a proof can brute-force low-entropy private witnesses by regenerating commitments over candidate values and matching them. The accompanying Go PoC demonstrates recovery of a 10-bit secret from a proof commitment. This directly violates the zero-knowledge privacy guarantee the zkVM advertises, exposing program traces, memory access patterns, and confidential inputs such as keys or merkle leaves. The protocol team acknowledged the finding and fixed it in pull request #61, with the recommended mitigation being an upgrade to gnark 0.11.0.
Mellow Flexible Vaults: RedeemQueue Accounting Mismatch Between Batch Creation and Claim Eligibility
The Mellow Flexible Vaults RedeemQueue has an inconsistent timestamp boundary between how batches are created and how claims are validated. When processing an oracle report, _handleReport decrements the latest eligible index (excluding the newest redemption request at or before the report timestamp) when building the batch, while the claim path allows redemption requests up to and including that same timestamp to be claimed from that batch. Consequently, a user whose redemption belongs to a later batch can withdraw assets from an earlier batch that never accounted for their shares, depleting the batch and causing other users' claims to fail or revert with division-by-zero. The affected shares then get baked into a subsequent batch the user can no longer claim from, producing permanent fund lockup. The protocol team fixed the issue in PR mellow-finance/flexible-vaults#11, and the report includes a reproduction test.
Mellow Flexible Vaults: cancelDepositRequest() always reverts due to modifying FenwickTree with wrong index
Mellow Flexible Vaults' DepositQueue.cancelDepositRequest() mistakenly uses the latest oracle price checkpoint's index to remove a user's pending deposit from the Fenwick tree that is indexed by deposit timestamps. Because the price-trace array has a different length and indexing basis than the timestamp-based request trace, the derived index is out of bounds and modify() reverts with IndexOutOfBounds on every call. As a result, depositors cannot cancel queued deposits and their funds stay locked until the queue naturally processes them, breaking a core piece of expected behavior without stealing funds. The protocol resolved it by deriving the Fenwick index from the user's request timestamp via lowerLookup() instead of the price checkpoint.
Mellow Flexible Vaults: Protocol Fee Multiple Accrual in Oracle.submitReports
Mellow Flexible Vaults' report-submission pipeline accrued protocol fees once per asset report instead of once per batch because the stored fee timestamp is refreshed only when the base asset is reported. When a single Oracle.submitReports transaction processes several non-base assets before the base asset, FeeManager.calculateFee repeatedly uses the same stale timestamp and mints protocol fees for the same elapsed period each time. The result is that a vault can overcharge protocol fees proportional to the number of non-base assets in a single batched submission. The finding was acknowledged and fixed by the protocol team, and the loss is economic: excessive fee shares minted to the fee recipient at the expense of vault shareholders.
All reports in this group
- Mellow Flexible Vaults: Protocol Fee Exponential Compounding in ShareModule.handleReportLogic error$0
- Mellow Flexible Vaults: Stuck `stETH` rewards in queue contractsLogic error$0
- Burve: Incorrect Netting Logic Leads to Excessive Withdrawal AmountsLogic error$0
- SEDA Protocol: Tallying a Data Request with a wildcard expression in its consensus filter will store non-deterministic data and cause a chain haltLogic error$0
- SEDA Protocol: Anyone can post a request with `gasPrice` of 0 to cause SEDA chain to haltLogic error$0
- SEDA Protocol: Anyone can crash validators with a Tally VM program that panics the call_result_write importLogic error$0
- SEDA Protocol: Anyone can pass any length to some Tally imports to inflate memory, induce OOM, and crash validatorsLogic error$0
- SEDA Protocol: Malicious contracts can force excessive memory usage at minimal gas cost, threatening node stability and economic securityLogic error$0
- Symmio, Staking and Vesting: USDC rewards will not be distributed if `_updateRewardsStates` is triggered too oftenOracle manipulation$0
- SEDA Protocol: Attackers can flood solvers with thousands of requests and prevent fee payoutsLogic error$0
- SEDA Protocol: ExecuteTallyVM has a memory leak which will lead to nodes eventually crashingLogic error$0
- SEDA Protocol: Mean-Based Outlier Detection Vulnerability Allows Single Node to Sabotage ConsensusLogic error$0
- SEDA Protocol: Data requests queue can be DoS'edLogic error$0
- SEDA Protocol: Attacker can exploits batch sender role to block result Submissions via fee transfer reversionLogic error$0
- SEDA Protocol: Gas costs are severely underpriced for certain WASM instructions which can lead to network DoSLogic error$0
- SEDA Protocol: Attackers can flood validators with Commit/Reveal execution messages to delay blocks or DOS the nodeLogic error$0
- SEDA Protocol: requestId has no unique parameters leading to different collisionsLogic error$0
- SEDA Protocol: Wrong amount of gas will be used in a certain caseLogic error$0
- SEDA Protocol: Tally VM startup costs not charged early enoughLogic error$0
- SEDA Protocol: A request poster can set gas_price to 1 and pay minimal fees for a lot of gas and drain validators' resourcesLogic error$0
- SEDA Protocol: WASI imports can be exploited for unmetered execution or unbounded memory growthLogic error$0
- SEDA Protocol: Executors will get underpaid while excessive gas will be refunded to the requestorLogic error$0
- SEDA Protocol: The outlier gets the reduced payout when there is consensus on errorsLogic error$0
- SEDA Protocol: Malicious validators will bypass consensus threshold requirements affecting the integrity of the SEDA protocol's cross-chain data verification systemLogic error$0
- SEDA Protocol: Signatures for the first batch will be rejected by VerifyVoteExtensionHandlerLogic error$0
- SEDA Protocol: Validators will not be able to sign first batchLogic error$0
- SEDA Protocol: A jailed validator with no registered key blocks proving scheme activationLogic error$0
- SEDA Protocol: `call_result_write` import can be exploited for unmetered execution and memory growthLogic error$0
- Nibiru: `IOracle.queryExchangeRate` returns incorrect `blockTimeMs`Oracle manipulation$0
- Nibiru: Gas is not consumed when precompile method fail, allowing resource consumption related DOSLogic error$0
- Peapods: spTKNMinimalOracle `_calculateSpTknPerBase()` does not calculate correct price for podded or fraxlend pair pairedLpTKNs.Oracle manipulation$0
- NOYA: `NoyaValueOracle.getValue` returns an incorrect price when a multi-token route is usedOracle manipulation$0
- NOYA: Value of asset token can be incorrect when usage of ETH/USD Chainlink oracle is neededOracle manipulation$0
- NOYA: `BalancerConnector` has incorrect implementation of totalSupply, positionTVL and total TVL will be invalidLogic error$0
- NOYA: `BalancerConnector::_getPositionTVL` is calculated incorrectlyLogic error$0
- Plaza Finance: Market rate never used due to decimal discrepancyLogic error$0
- Plaza Finance: Wrong modifier on `PreDeposit::setBondAndLeverageAmount` function leads to big differences in user balancesLogic error$0
- Plaza Finance: Attacker can drain most of the reserves by weaponizing USDC blacklistingLogic error$0
- Oku's New Order Types Contract: Incorrect Freshness Logic Validation in PythOracle breaking the entire mechanism for triggering ordersOracle manipulation$0
- Oku's New Order Types Contract: Malicious users can `createOrder` with `0 amount` and make `DOS` for allLogic error$0
- Oku's New Order Types Contract: Insecure calls to `safeTransferFrom` leads to users tokens steal by attackerAccess control$0
- MorphL2: Delegators can lose their rewards when a delegator has removed a delegatee and claims all of his rewards before delegating again to a previous removed delegatee.Logic error$0
- MorphL2: Sequencer will be underpaid because of incorrect `commitScalar`Oracle manipulation$0
- Size: Inadequate checks to confirm the correct status of the sequence/`sequencerUptimeFeed` in `PriceFeed.getPrice()` contractLogic error$0
- Perennial V2 Update #3: Corrupted storage after upgrade in the `MarketFactory` contract.Logic error$0
- Perennial V2 Update #3: settle() asyncFee is left in the KeepFactory and is not transfer to the keeper.Logic error$0
- Velar Artha PerpDEX: Not decreasing oracle timestamp validation leads to DoS for protocol usersLogic error$0
- Velar Artha PerpDEX: LPs will withdraw more value than deposited during pegged token de-peg eventsOracle manipulation$0
- BendDAO: PriceOracle has invalid checks on price stalenessOracle manipulation$0
- Optimism: LPP metadata can be altered after the challenge period is over, allowing incorrect states to be provenOracle manipulation$0
- Optimism: An attacker can bypass the challenge period during LPP finalizationOracle manipulation$0
- Optimism: L2 precompile calls can be impossible to reproduce on L1Oracle manipulation$0
- Optimism: Invalid `DISPUTED_L2_BLOCK_NUMBER` is passed to VMLogic error$0
- Optimism: The LPP proposer may not be reimbursed their gas costs by the bonds at `MAX_GAME_DEPTH` because `step()` does not check if the LPP proposer is the one that called itLogic error$0
- Optimism: Addresses can be pre-populated with bad dataLogic error$0
- Vultisig: Vultisig whitelisting can be bypassed by anyoneAccess control$0
- DittoETH: Users can evade the `yDUSD` vault's withdrawal timelock mechanismLogic error$0
- DittoETH: Incorrect accounting bug of the `yDUSD` vault leads to total loss of depositors' `DUSD` assetsLogic error$0
- Allora: The SelectTopNWorkerNonces function lacks a sorting algorithm internally.Logic error$0
- Allora: Silent Failure in MustNewDecFromString Can Lead to Node CrashesLogic error$0
- Allora: The worker and reputer's payload may be tampered due to lack of check for the pubkey's ownershipLogic error$0
- Allora: The malicious node may not execute the http requestLogic error$0
- Allora: Not appropriate Inferences will be used when calculating the forecastLogic error$0
- Mellow Modular LRTs: `ratiosX96Value` rounds in favor of user and not vaultLogic error$0
- Mellow Modular LRTs: Corrupted oracle system if more than 2 underlying tokens are used and one of them is WSTETHLogic error$0
- DittoETH: `oracleCircuitBreaker`: Not checking if price information of asset is staleOracle manipulation$0
- Munchables: Missing disapproval check in `LockManager.sol::approveUSDPrice` allows simultaneous approval and disapproval of a price proposalOracle manipulation$0
- Elfi: If stable tokens depeg, short funding fees will not be accounted properlyLogic error$0
- Elfi: Users can use weth to replace any margin token in createUpdatePositionMarginRequest()Logic error$0
- Elfi: Pool value calculation skips accounting for stable token losses and short uPnLLogic error$0
- Elfi: Users can gas grief or completely block keepers from executing ordersLogic error$0
- Elfi: A significant ````105,983```` gas cost of ````processExecutionFee()```` execution is not accounted in the keeper's compensationLogic error$0
- Elfi: Missing compensation for the ````21,000```` intrinsic gas costLogic error$0
- Elfi: Closing positions does not decrease the pool's entry price, leading to misleading pool value calculationsLogic error$0
- Inverter Network: LM_PC_KPIRewarder_v1` if bond token has a blocklist and disputer set disputer address to a blocked address, result in DoSLogic error$0
- Renzo: `calculateTVL` may run out of gas for modest number of operators and tokens breaking deposits, withdrawals, and tradesOracle manipulation$0
- Renzo: Withdrawals and Claims are meant to be pausable, but it is not possible in practiceLogic error$0
- Inverter Network: LM_PC_KPIRewarder_v1.sol#assertionResolvedCallback() - `LM_PC_KPIRewarder_v1` can be set as a callback address to another assertion in order to set `assertionPending = false`Logic error$0
- Tapioca DAO: `AirdropBroker`: Airdrops in epoch 4 can participate and exercise options in subsequent epochsLogic error$0
- Tapioca DAO: Adversary can utilise approved to Magnetar `oTAP` and `tOLP` NFTsAccess control$0
- Tapioca DAO: `AirdropBroker`: When `block.timestamp == lastEpochUpdate + EPOCH_DURATION`, users can exercise options in the new epoch.Logic error$0
- Revert Lend: Large decimal of `referenceToken` causes overflow at oracle price calculationOracle manipulation$0
- Abracadabra Money: `MagicLpAggregator` can be incompatible with potential integrators due to incorrect `latestRoundData` functionOracle manipulation$0
- Ondo Finance: `OUSGInstantManager` will allow excessive `OUSG` token minting during `USDC` depeg eventOracle manipulation$0
- Salty.IO: DOS of proposals by abusing ballot names without important parametersLogic error$0
- Flat Money Fix Review: Attacker can steal LPs funds by using different oracle prices in the same transactionOracle manipulation$0
- Perennial V2 Update #2: Vault global shares and assets change will mismatch local shares and assets change during settlement due to incorrect `_withoutSettlementFeeGlobal` formulaLogic error$0
- Perennial V2 Update #2: ChainlinkFactory will pay non-requested versions keeper feesOracle manipulation$0
- Perennial V2 Update #2: Requested oracle versions, which have expired, must return this oracle version as invalid, but they return it as a normal version with previous version's price insteadLogic error$0
- Perennial V2 Update #2: Orders on Optimism chains can not be settled due to revert of ````keep()````Logic error$0
- Optimism Fault Proofs: Fault game factory can be manipulated to DOS game type using malicious `l2BlockNumber`Logic error$0
- Perpetual: OracleMaker's price with spread does not take into account the new positionLogic error$0
- Tapioca: TOFTOptionsReceiverModule will have the user lose the whole output TAP when requested to exercise all eligible optionsLogic error$0
- Rio Network: The protocol can't receive rewards because of low gas limits on ETH transfersLogic error$0
- Rio Network: A part of ETH rewards can be stolen by sandwiching `claimDelayedWithdrawals()`Logic error$0
- Rio Network: ETH withdrawers do not earn yield while waiting for a withdrawalLogic error$0
- Smilee Finance: Position Manager providing the wrong strike when storing user's position dataLogic error$0
- Napier: Lack of slippage control for `issue` functionLogic error$0
- Asymmetry Finance: Intrinsic arbitrage from price discrepancyLogic error$0
- Asymmetry Finance: Missing circuit breaker checks in `ethPerCvx()` for Chainlink's price feedOracle manipulation$0
- Notional Update #5: getOracleData() maxExternalDeposit not accurateLogic error$0
- INIT Capital: API3 oracle timestamp can be set to future timestamp and block API3 Oracle usage to make code revert in underflowOracle manipulation$0
- NextGen: The `RandomizerVRF` and `RandomizerRNG` do not produce hash value.Oracle manipulation$0
- Open Dollar: Decimal Limitation in CamelotRelayer and UniV3Relayer Contract DeploymentOracle manipulation$0
- Kelp DAO: Protocol mints less rsETH on deposit than intendedReentrancy$0
- Kelp DAO: The price of rsETH could be manipulated by the first stakerOracle manipulation$0
- Kelp DAO: Update in strategy will cause wrong issuance of sharesOracle manipulation$0
- Tapioca DAO: Attacker can prevent rewards from being issued to gauges for a given epoch in TapiocaOptionBrokerOracle manipulation$0
- Asymmetry Finance: Price of sfrxEth derivative is calculated incorrectlyOracle manipulation$0