Track 7 · The Breach Lab · lesson 8

Oracle manipulation

20 min

A contract that needs to know a price cannot look it up — the EVM has no internet. It has to ask an oracle: another contract that reports the price.

The attack is to make the oracle lie for one block.

The classic mistake is using a DEX pool's current ratio as the price. That number is real, live, and trivially movable: a large enough trade shifts the ratio, and any contract reading it in the same block sees the shifted number as truth.

Borrow against that inflated price, take the loan, let the price snap back. The oracle was never hacked — it reported exactly what the pool said, and the pool said what you paid it to say.

Spot price versus time-weighted

// Reads the pool's instantaneous ratio. One big trade moves it.
function collateralValue(uint256 amount) public view returns (uint256) {
  uint256 spot = pool.reserve1() * 1e18 / pool.reserve0();
  return amount * spot / 1e18;   // believes a number you can push
}

A spot price is the pool's ratio right now. A flash loan can move it enormously for a single transaction, and this contract believes it.

Why the time-weighted version resists it

To move a 30-minute average, an attacker has to hold the price away from the true value for a meaningful fraction of that window — across many blocks, exposed to arbitrageurs the whole time. The cost of that dwarfs anything a single-block loan can extract.

It is not immune. It is expensive enough to attack that it usually is not worth it — the same shape of defence as consensus itself.

Predict

Why is a DEX spot price so easy to manipulate for one block?

Choose one answer

Check

Why does a TWAP resist single-block manipulation?

Choose one answer

Worth remembering

  • Contracts get prices from oracles because the EVM cannot look anything up.
  • A DEX spot price is the pool's current ratio and moves with a single large trade.
  • Borrowing against a manipulated spot price is oracle manipulation — the oracle isn't hacked, the pool is moved.
  • A time-weighted average price (TWAP) forces an attacker to hold the price for many blocks, which is prohibitively expensive.
  • Oracle manipulation and flash loans are usually two halves of one attack.