Stratax Contracts
First Flight #57
Beginner FriendlyDeFi
100 EXP
View all submissions
Previous Next
Submission Details
Impact: medium
Likelihood: medium

Oracle Admin Can Retroactively Manipulate User Outcomes

Author Revealed upon completion

Root + Impact

Description

  • Normally, oracle updates are assumed to reflect objective market conditions.

The oracle owner can arbitrarily update prices at any time, including after user actions but before settlement, enabling retroactive value manipulation.

// Root cause in the codebase with @> marks to highlight the relevant section
​
// StrataxOracle.sol
// @> Owner-controlled price update
function setPrice(address asset, uint256 price) external onlyOwner {
prices[asset] = price;
}
​

Risk

Likelihood:

  • Occurs whenever oracle updates are manually triggered.

Can happen during normal protocol operation without abnormal inputs.

Impact:

  • Users receive unfair outcomes based on manipulated pricing.

Protocol trust assumptions are violated.

Proof of Concept

user.deposit(100);
​
// Owner updates price downward
oracle.setPrice(asset, 50);
​
// User withdraws at manipulated valuation
withdraw();
​

Recommended Mitigation

  • Introduce delayed price activation.

Use commit–reveal or time-weighted averaging.

  • Restrict price updates during active accounting windows.

- remove this code
+ add this code

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!