# flash loan oracle manipulation enables price feed attacks against defi protocols By atomically borrowing large capital through flash loans, an attacker can skew spot prices that on-chain oracles report, causing downstream protocols to misprice assets within a single transaction ($33.8M in 2024 losses). The most common vector is [[AMM spot prices are manipulable within a single transaction making them unsafe as oracle price feeds without TWAP smoothing|AMM spot price manipulation]]: borrow via flash loan, swap to move the AMM price, exploit any protocol using that price as an oracle. The attack is self-funding (no capital at risk). Since [[frontrunning exploits public mempool visibility to insert competing transactions before profitable pending operations]], flash loan attacks and frontrunning often combine. Flash loans also enable [[low-participation governance votes enable protocol parameter manipulation through flash loan voting power|governance attacks]] by borrowing voting tokens within a single transaction. **bZx Incident 1 (~$350K, February 15, 2020):** The founding flash loan oracle manipulation attack in DeFi. The attacker borrowed 10,000 ETH via dYdX, opened a 5x leveraged short on bZx, routed through KyberSwap into Uniswap causing 3x WBTC price inflation, then sold 112 WBTC from Compound at the inflated price. A boolean OR condition bug in `shouldLiquidate()` bypassed the collateral health check, enabling the trade to proceed despite undercollateralization. See [[the bZx February 2020 exploits demonstrated that flash loans enabled the first prominent DeFi oracle manipulation attacks by combining spot price manipulation with undercollateralization bypass]]. **bZx Incident 2 (~$600K, February 18, 2020):** Three days later, the attacker made 19 successive sUSD purchases on Kyber to inflate the sUSD/ETH rate, then deposited sUSD at the manipulated valuation as bZx collateral and borrowed 6,796 ETH. bZx's spread check between Kyber and Uniswap failed because Kyber's price derived directly from Uniswap reserves; both moved together, preserving the spread while both reported an inflated value. See [[oracle spread checks fail to detect manipulation when multiple price sources derive from the same upstream because both sources move together preserving the spread]]. **UwU Lend ($23M, June 2024):** An Aave v2 fork using Curve's `get_p()` spot prices. The attacker coordinated $3.796 billion in flash loans across seven protocols to manipulate sUSDE's oracle price. Curve's `get_p()` is explicitly documented as manipulable, and using it as an oracle feed in a lending protocol enabled the median-manipulation attack. The audit's exclusion of oracle review left this unexamined. **Mango Markets ($114M, October 2022):** Did not use flash loans. Eisenberg deposited ~$10M USDC across two accounts and used spot purchases to move MNGO price from ~$0.038 to $0.91 on an illiquid token, then drained ~$114M from protocol reserves against inflated PnL collateral. See [[the Mango Markets exploit demonstrated that thin-liquidity oracle manipulation combined with unrealized PnL as collateral enables full protocol drain through controlled spot price inflation]]. **WOOFi ($8.75M, March 2024, Arbitrum):** Used flash loans to exploit an arithmetic boundary condition in WOOFi's sPMM price formula. The attacker borrowed 10.6M USDC from Uniswap V3 and 270.5M WOO from a Trader Joe lending pool, then used a four-swap sequence to collapse the sPMM-reported WOO price to $0.00000009. A missing Chainlink fallback oracle (never configured for WOO via the `setOracle()` admin function) allowed the near-zero price to pass unchecked. See [[the WOOFi sPMM exploit demonstrated that arithmetic boundary conditions in dynamic price adjustment formulas combined with unconfigured oracle fallbacks enable flash-loan-amplified pool drainage]]. **Cream Finance (~$130M, October 27, 2021):** The first exploit to use vault pricePerShare oracle manipulation. Cream's `PriceOracleProxy` computed yUSDVault token prices using `pricePerShare = vaultBalance / totalSupply`, reading live on-chain vault state. The attacker aggregated $500M DAI from MakerDAO and approximately $2B ETH from AAVE v2 in a single transaction, then used two coordinating addresses to accumulate approximately $1.5B in crYUSD collateral on Address A via recursive borrow-and-transfer. Address A donated 8,431,514 yUSD directly to the Yearn yUSD vault, doubling `pricePerShare` from approximately 1.000996 to 2.001993. Cream's oracle reported $3B in collateral against $1.5B in real debt, enabling a $130M drain. Unlike AMM spot price manipulation, this variant requires no DEX trades: the oracle is written by direct token transfer to the vault. Since [[vault token oracle proxies that derive price from on-chain pricePerShare are manipulable by direct token donation to the underlying vault]], any lending protocol pricing vault tokens via on-chain share price arithmetic is exposed. See [[the Cream Finance October 2021 exploit demonstrated that oracle proxies for wrapped vault tokens in Compound v2 fork lending protocols enable $130M collateral inflation via pricePerShare manipulation]]. **PancakeBunny ($45M, May 19, 2021, BSC):** A sixth mechanistically distinct oracle attack class. The oracle target is LP token value in a yield aggregator minting context, not raw token price, vault share price, or AMM spot for lending collateral. BunnyMinterV2 called `PriceCalculatorBSCV1.valueOfAsset()`, which computed LP value as `amount * reserve0 * 2 / totalSupply`. The attacker borrowed >$700M across 8 flash loans, swapped 2.3M WBNB to distort the WBNB reserve, and triggered getReward() on a $380 vault deposit. The inflated reserve caused BunnyMinterV2 to mint 6.97M BUNNY tokens. An amplification mechanism in `_zapAssetsToBunnyBNB()` calling removeLiquidity() on an LP balance augmented with 144,445 attacker-minted tokens further compounded the extraction. BUNNY crashed 95%+ from ~$146 to ~$6.17. This attack triggered a BSC ecosystem wave: bEarn, Belt Finance, BurgerSwap, and AutoShark were hit within weeks because they shared the same PancakeSwap reserve-based oracle design pattern. See [[the PancakeBunny exploit demonstrated that AMM reserve-based LP token valuation in yield aggregator minters enables flash-loan-driven unbounded token minting]] and [[LP token valuation formulas using raw AMM reserve ratios are manipulable within a single transaction when reserves can be distorted by a large swap]]. **Flash loan + precision loss:** A distinct variant combines flash loans with precision truncation. When `from18(amount)` truncates to zero, attackers receive tokens while paying nothing. See [[precision loss in DeFi can be weaponized to drain funds rather than merely disadvantaging users]]. **BonqDAO (notional ~$120M, February 2023, Polygon):** A fifth mechanistically distinct oracle attack class. No flash loans were required; the attacker staked 10 TRB (~$175) on TellorFlex, submitted a WALBT price of $5,000,000, and minted ~100M BEUR before any dispute could resolve. The manipulation spanned multiple transactions (not atomic) and required no DEX interaction. The oracle's dispute window was the sole manipulation-resistance layer, and BonqDAO's `updatePrice()` bypassed it by consuming the latest submitted value immediately. This represents permissionless staking-based oracle manipulation: attack cost is bounded by the minimum reporter stake, not by DEX liquidity or borrowed capital. See [[permissionless oracle reporter systems with low minimum staking thresholds allow attackers to submit manipulated price data for the cost of the stake]] and [[instant oracle price consumption without dispute period validation transforms permissionless oracle reports into single-transaction manipulation vectors]] and [[the BonqDAO exploit demonstrated that consuming the latest submitted oracle value without enforcing the dispute window converts a protocol's safety period into an exploitable race condition]]. **TWAP mitigations are not unconditional:** TWAP is the standard defense against AMM spot price manipulation, but since [[TWAP bypass via asymmetric enforcement allows attackers to exploit unprotected owner functions when calm-period checks guard only non-owner paths]], a TWAP check applied only to user-facing code paths leaves owner-privileged paths fully exposed during active flash loan manipulation. **EIP-7702 and defense invalidation:** The primary runtime guard against flash loan attacks was `require(tx.origin == msg.sender)`, blocking contract-mediated calls. Since [[EIP-7702 tx.origin equals msg.sender check no longer prevents flash loan attacks because delegated EOAs can execute arbitrary contract logic while satisfying both identity checks]], this defense is structurally bypassed post-Pectra. Protocols that relied on this guard for oracle manipulation prevention must migrate to delegation-aware detection. --- Relevant Notes: - [[the bZx February 2020 exploits demonstrated that flash loans enabled the first prominent DeFi oracle manipulation attacks by combining spot price manipulation with undercollateralization bypass]]: example: founding 2020 case predating all other examples by two to four years; two mechanistically distinct incidents within three days - [[oracle spread checks fail to detect manipulation when multiple price sources derive from the same upstream because both sources move together preserving the spread]]: extends: bZx Incident 2 demonstrates a specific defense-defeating pattern; spread checks provide zero redundancy when sources share a common upstream - [[AMM spot prices are manipulable within a single transaction making them unsafe as oracle price feeds without TWAP smoothing]]: the most common oracle being manipulated via flash loans - [[TWAP bypass via asymmetric enforcement allows attackers to exploit unprotected owner functions when calm-period checks guard only non-owner paths]]: extends: the primary TWAP mitigation for flash loan price manipulation can be defeated when calm-period checks are applied asymmetrically across function paths - [[the Mango Markets exploit demonstrated that thin-liquidity oracle manipulation combined with unrealized PnL as collateral enables full protocol drain through controlled spot price inflation]]: extends: Mango shows oracle manipulation without flash loans via thin-liquidity spot purchases - [[read-only reentrancy exploits view functions to cause other protocols to read inconsistent state]]: a related pattern that also exploits stale protocol data - [[frontrunning exploits public mempool visibility to insert competing transactions before profitable pending operations]]: flash loan manipulation and frontrunning frequently combine as MEV extraction strategies - [[Chainlink oracle front-running is possible because price feed updates are public transactions that allow sandwiching of oracle price changes]]: contrast: this note covers attacker-induced price manipulation; Chainlink front-running exploits the predictable timing of legitimate oracle updates; both are oracle attack vectors but operate at different layers - [[Chainlink minAnswer and maxAnswer price bounds cause oracles to report incorrect prices during flash crashes and extreme events]]: related: flash-loan-induced price crashes and natural flash crashes can both trigger the Chainlink minAnswer floor, causing the oracle to report an incorrect price independently of the manipulation - [[EIP-7702 tx.origin equals msg.sender check no longer prevents flash loan attacks because delegated EOAs can execute arbitrary contract logic while satisfying both identity checks]]: extends: the primary runtime guard against flash loan attacks is structurally bypassed post-Pectra; protocols relying on tx.origin==msg.sender for oracle manipulation prevention must migrate - [[low-participation governance votes enable protocol parameter manipulation through flash loan voting power]]: flash loans applied to governance token voting - [[bad debt accumulation in lending protocols occurs when liquidations fail to clear underwater positions during extreme market events]]: Black Thursday demonstrated oracle failure leading to under-collateralized liquidations - [[precision loss in DeFi can be weaponized to drain funds rather than merely disadvantaging users]]: extends: flash loan + precision truncation enables free governance token acquisition when from18() returns zero - [[the Cream Finance October 2021 exploit demonstrated that oracle proxies for wrapped vault tokens in Compound v2 fork lending protocols enable $130M collateral inflation via pricePerShare manipulation]]: extends: fourth mechanistically distinct case; vault pricePerShare oracle manipulation via direct token donation, distinct from AMM spot prices, sPMM formula arithmetic, and thin-liquidity spot purchases - [[vault token oracle proxies that derive price from on-chain pricePerShare are manipulable by direct token donation to the underlying vault]]: foundation: the vulnerability class enabling the Cream Finance oracle manipulation variant - [[the WOOFi sPMM exploit demonstrated that arithmetic boundary conditions in dynamic price adjustment formulas combined with unconfigured oracle fallbacks enable flash-loan-amplified pool drainage]]: extends: third mechanistically distinct case; sPMM formula arithmetic boundary + unconfigured Chainlink fallback, distinct from Curve get_p() and Mango thin-liquidity spot purchases - [[automated security tooling reliably detects code-level flaws but structurally misses design-level economic and cross-system vulnerabilities that dominate high-value exploits]]: extends: flash loan oracle manipulation is the canonical example of a cross-system economic attack that falls outside all automated tooling scope - [[the PancakeBunny exploit demonstrated that AMM reserve-based LP token valuation in yield aggregator minters enables flash-loan-driven unbounded token minting]]: example: sixth mechanistically distinct case; yield aggregator minting context with LP token value as oracle target, $45M, BSC May 2021 - [[LP token valuation formulas using raw AMM reserve ratios are manipulable within a single transaction when reserves can be distorted by a large swap]]: foundation: the specific vulnerable oracle design enabling the PancakeBunny variant - [[permissionless oracle reporter systems with low minimum staking thresholds allow attackers to submit manipulated price data for the cost of the stake]]: extends: BonqDAO fifth case; staking-based manipulation requires only minimum reporter stake rather than flash loan capital; distinct attack economics - [[instant oracle price consumption without dispute period validation transforms permissionless oracle reports into single-transaction manipulation vectors]]: extends: the vulnerability pattern enabling the BonqDAO staking-based manipulation; distinct from AMM spot price TWAP defense - [[the BonqDAO exploit demonstrated that consuming the latest submitted oracle value without enforcing the dispute window converts a protocol's safety period into an exploitable race condition]]: example: fifth mechanistically distinct case; TellorFlex dispute-period bypass with $175 attack cost - [[flash loans eliminate capital requirements for economic attacks making exploitation scale bounded only by total DeFi liquidity not attacker wealth]]: foundation: the economic framework explaining why flash loans transform DeFi security; attack scale is bounded by available liquidity rather than attacker capital Topics: - [[vulnerability-patterns]] - [[protocol-mechanics]]