Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

[H-2] Front-Runnable Liquidations via Stale Oracles at PerpsEngine

0xsnoweth

Summary

The LiquidationBranch liquidates accounts based on stale oracle prices, allowing keepers to profit via front-running.

Vulnerability Details

Affected Code:

// LiquidationBranch.sol (hypothetical)
function liquidateAccount(address account) public {
uint256 price = oracle.getPrice(); // No timestamp check
if (isUnderCollateralized(account, price)) {
seizeCollateral(account);
}
}

Exploit Scenario:

  1. Keeper sees pending large trade that will drop asset price.

  2. Front-runs by liquidating accounts at outdated higher price.

  3. Profit from price difference post-trade.

Proof of Concept:

​
// Foundry test simulating price manipulation
function testLiquidationFrontrun() public {
oracle.setPrice(1000e18); // Current price
account.deposit(100e18);
// Attacker front-runs price update
vm.prank(keeper);
engine.liquidateAccount(account); // Uses $1000 price
// Price drops to $900 after trade
oracle.setPrice(900e18);
// Victim's collateral now worth less, but already liquidated unfairly
}

Impact

Unfair Liquidations: Users lose funds due to MEV.

Keeper Extractable Value (KEV): High severity (CVSS 8.9).

Tools Used

Forked mainnet testing with real oracle.

MEV bot simulation.

Recommendations

// Add price freshness and sanity checks
require(block.timestamp - oracleUpdatedAt < 30 seconds, "Stale price");
require(price > 0 && price < MAX_SANE_VALUE, "Invalid price");
Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.