Spot Price Oracle Manipulation Leads to Vault Share Inflation

Description

• The protocol calculates flashloan fees based on the market value of the borrowed token using an oracle that returns the token’s price in WETH. This fee is then added to the vault’s exchange rate, increasing the value of AssetToken shares and distributing flashloan revenue proportionally to depositors. Under normal conditions, the oracle price reflects the fair market value of the token, ensuring accurate fee calculation and fair yield distribution.

• The protocol relies on a manipulable AMM spot price as its oracle source without any time-weighting, delay, or sanity checks. Because AMM spot prices can be temporarily distorted within a single transaction using large swaps or flashloans, an attacker can artificially inflate or deflate the token price. Since flashloan fees and exchange rate updates depend directly on this price, the attacker can manipulate the oracle to influence fee calculations and vault share value in their favor, potentially enabling economic extraction from the vault.

Risk

Likelihood:

• This vulnerability materializes whenever the referenced AMM pool has low or moderate liquidity and allows large swaps to significantly shift the spot price within a single transaction. During periods of low liquidity or concentrated liquidity imbalance, a sufficiently funded attacker can distort the spot price, trigger a flashloan, and influence the exchange rate calculation before the market corrects.

Impact:

• Vault Share Inflation: Because the flashloan fee is calculated using a manipulable spot price and directly increases the exchange rate, an attacker can artificially inflate the value of AssetToken shares within a single transaction. This breaks the integrity of the vault’s accounting system.

• Artificial exchange rate inflation enables an attacker to redeem shares at an inflated value, extracting more underlying tokens than economically justified. This results in a direct loss of funds from the vault, impacting honest depositors.

• The attacker can artificially reduce or increase flashloan fees by distorting the oracle price. This allows them to; Pay significantly lower fees than intended, or Manipulate accounting to create disproportionate value shifts inside the vault.

Proof of Concept

Recommended Mitigation