Skip to content
DeFi Reference

Oracle manipulation — incidents, TWAP under PoS, and enshrined feeds

1. TL;DR

Section titled “1. TL;DR”

Every major oracle-manipulation loss follows one of three patterns: an attacker temporarily distorts a thinly-liquid price and extracts more than they deposited, then reverses the distortion — bZx (Feb 2020) and Harvest Finance (Oct 2020, over $33M); an attacker inflates the very token a protocol treats as collateral, a feedback loop rather than a simple trade — Mango Markets (Oct 2022, ~$116M) and Inverse Finance (Apr 2022, $15.6M); or an oracle silently stops reflecting reality during extreme volatility and a protocol keeps trusting its last value — Venus during the Terra/LUNA collapse (May 2022, ~$11.2M bad debt). Layered on top is a Proof-of-Stake problem: since a validator or pool can win several consecutive block slots, the “it takes many blocks to move a time-weighted average” assumption behind TWAP is weaker than under Proof-of-Work, reviving a debate over whether price feeds belong in Ethereum’s protocol itself.

2. Explain it simply

Section titled “2. Explain it simply”

Analogy

Section titled “Analogy”

Picture a farmers’ market with one apple stall, and a bank next door that lends against apples using the stall’s current asking price. Buy out most of the stall’s apples and the price spikes; put your remaining apples up as collateral and the bank lends against that inflated price; sell the apples back and the price resets — you walk away having borrowed far more than they were worth. The bank never checked whether the momentary price reflected anything but the trade you yourself just made.

ELI5

Section titled “ELI5”

A price oracle tells a smart contract “here’s what this token is worth right now.” If that oracle just looks at the last trade on one small trading pool, someone with enough money can trade in a way that briefly makes the price say whatever they want, borrow or withdraw money based on that fake price, then trade back to make the price look normal again — like tricking a scale by leaning on it right before someone reads the number, then stepping off. Sometimes the trick isn’t about a trade at all: if a price reporter goes quiet during a crash instead of reporting something obviously broken, a protocol that keeps using its last, now-wrong number can be tricked into accepting worthless collateral as if it still had value.

Step-by-step walkthrough

Section titled “Step-by-step walkthrough”

Scenario (illustrative, modeled on the real Harvest Finance attack pattern with simplified numbers): a yield vault values its shares using the spot price of USDC inside a Curve pool holding 10,000,000 USDC and 10,000,000 DAI+USDT combined.

  1. Before (state: 1 USDC = $1.00; vault share price = $1.00; attacker holds 2,000,000 USDC). The vault reads the Curve pool’s instantaneous exchange rate to price a deposit, with no time-averaging.
  2. Deflate. The attacker swaps 2,000,000 USDC into the pool, pushing the pool’s internal USDC price down to $0.97 for that block.
  3. Enter at the deflated price. In the same transaction, the attacker deposits USDC into the vault at the deflated valuation, receiving more vault shares per dollar than they should.
  4. Restore. The attacker swaps their DAI/USDT back into USDC, returning the pool’s price to $1.00.
  5. After (state: attacker withdraws at the now-correct $1.00 share price, extracting more value than deposited, paid for by other depositors). No external party was fooled — the vault’s own contract was the oracle, reading a price it had itself just been manipulated into reporting.

Common misconceptions

Section titled “Common misconceptions”
  • Myth: Oracle manipulation always requires a flash loan. Reality: Inverse Finance’s exploit sustained ownership of manipulated INV across the whole exploit, funding it with ~$3M via Tornado Cash rather than a same-block loan.
  • Myth: “The oracle” is always a clearly-labeled price feed. Reality: samczsun’s post notes “price oracles are not always conveniently labelled as such” — the yEarn/Balancer BPT-redemption bug was an unlabeled oracle, just as manipulable as an explicit one.
  • Myth: A paused or stale oracle fails safe. Reality: Venus’s Chainlink LUNA/USD feed hit its floor and stopped updating during the crash, and Venus kept accepting LUNA at that stale price, because it “failed to account for oracle liveliness.”
  • Myth: TWAP is immune to manipulation. Reality: It only raises the cost by requiring manipulation to persist across many blocks; under Proof-of-Stake, a validator with enough stake has “a high probability of producing consecutive blocks,” weakening that assumption (Revuelta, cited ethresear.ch/t/15010, 2023-03).

If you only remember one thing

Section titled “If you only remember one thing”

Every oracle-manipulation exploit reduces to one question a protocol failed to ask: can whoever is about to use this price also be the one who just set it?

3. How it works

Section titled “3. How it works”

The undercollateralized-loan template

Section titled “The undercollateralized-loan template”

samczsun’s canonical description: an attacker inflates the price of an asset by trading against a thin pool, deposits that asset as collateral into a protocol reading the pool’s spot price directly, borrows the maximum the inflated collateral allows, then reverses the trade to restore the price and walks away with the borrowed amount uncollateralized. The core insight: “the spot price on a decentralized exchange may be wildly incorrect during a transaction,” because “an attacker has almost full control over the price during a transaction and trying to read that price accurately is like reading the weight on a scale before it’s finished settling.” bZx (February 2020) followed this template using Kyber and Synthetix’s sUSD market; Harvest Finance (over $33M, as of 2020-10) followed it against a Curve pool feeding a yield vault’s share price, as in §2.

The self-referential collateral template

Section titled “The self-referential collateral template”

A more damaging variant: the manipulated asset is the very token a protocol treats as native collateral, not a stand-in for value stolen elsewhere. Mango Markets (~$116M per the SEC’s complaint, as of 2022-10): the exploiter deposited a small amount of capital, opened an aggressively large long position in MNGO perpetual futures, and used buying pressure to drive MNGO’s price up roughly 1,000% in an hour — inflating the mark-to-market value of his own position, which he then borrowed against, manufacturing his own collateral rather than merely distorting someone else’s price. Inverse Finance (April 2022) shares the same shape at smaller scale: the attacker pumped INV — Inverse’s own governance token, thinly traded on Sushiswap via a Keep3r-based oracle — to $20,926, then deposited 1,700 INV to borrow 1,588 ETH, 94 WBTC, 4,000,000 DOLA, and 39.3 YFI, worth $15.6M (as of 2022-04).

The stale-or-paused-oracle template

Section titled “The stale-or-paused-oracle template”

Venus’s May 2022 exposure to Terra’s LUNA collapse is mechanistically different: no attacker manipulated a trading venue. Chainlink’s LUNA/USD feed (see /oracles/push-vs-pull-vs-twap/) is configured with min/max answer bounds guarding against erroneous inputs; as LUNA’s real price collapsed toward zero, the feed hit its floor near $0.10 and stopped updating, while the actual market price kept falling below $0.01. Venus did not detect the feed had stopped reflecting reality and kept accepting LUNA at the stale $0.10 floor — it “failed to account for oracle liveliness and didn’t check whether the last reported LUNA price was within the min & max price threshold.” An attacker bought real LUNA cheaply and deposited it at the stale, far higher oracle price to borrow against value that no longer existed, leaving Venus approximately $11.2M in bad debt (as of 2022-05).

TWAP manipulation under Proof-of-Stake

Section titled “TWAP manipulation under Proof-of-Stake”

Under Proof-of-Work, sustaining a price distortion across a TWAP window’s many blocks required enormous hash power or collusion with several independent miners in a row — both rare. Alvaro Revuelta’s analysis of post-Merge Ethereum found large validators/pools have a materially higher chance of proposing consecutive blocks than mining implied, a direct increase in TWAP manipulation risk under PoS (ethresear.ch/t/15010, 2023-03) — concretely enough that Euler moved several markets from a Uniswap TWAP to Chainlink in response (EIP-30, cited in the same thread).

One mitigation is an outlier-detection guard on recent observations, parameterized by observation count, step size, tolerated outliers, and max deltas. With OBSERVATIONS=8, MAX_OUTLIERS=4, SKIP=2, an attacker needs more than 4 manipulated observations, spanning roughly 1.5×8−4=81.5 \times 8 - 4 = 8 blocks of control at minimum, at an estimated gas cost of ~100,000 (ethresear.ch/t/15010, 2023-03). A separate proposal argues medians resist single-block manipulation better because “the outlier values will be thrown out unless the attacker can persist them for half the window size” — but Buterin notes an attacker proposing several consecutive blocks can push the price in one, hold it, then reverse it, at which point “the median will immediately ‘snap’ to this bad price” once manipulated observations exceed half the window, “whereas a TWAP would still be catching up” (ethresear.ch/t/12778, 2022-06). Uniswap v3’s per-block tick limits bound how far even a naive TWAP can move in one block — empirically around 70% of a 30-minute window.

The enshrined-price-feed debate

Section titled “The enshrined-price-feed debate”

A different response — years before the PoS concerns above — is to have Ethereum’s own protocol carry a price feed. Drake’s 2020 proposal adds a price_data field to every beacon block, treated like graffiti (ignored by the state-transition function), letting a contract take the median of up to 256 validator-reported prices per epoch boundary as an “honest-majority” oracle. Buterin’s objection: this “aims to introduce a property of the chain that cannot be programmatically verified under any assumption even in principle,” unlike a state transition’s validity — and relies on honest-majority assumptions where Eth2’s design was building “second lines of defense” against such failure. His counter-proposal, dual-token oracles, requires both a validator slot and a separate oracle token to vote, combining high budget with high cost (a slashable token penalizing lying) — a pure enshrined feed has high budget but low cost; existing token oracles have budget and cost both equal to the token’s market cap. Neither side converted the other, and no enshrined feed has shipped.

4. Worked numeric example

Section titled “4. Worked numeric example”

Comparing the five incidents by mechanism and scale (figures as reported at the time):

IncidentDateLoss (approx.)Mechanism template
bZx (second hack)2020-02~$1M combined across both February 2020 hacksUndercollateralized loan — inflate sUSD via Kyber/Synthetix, borrow ETH against it
Harvest Finance2020-10-26$33M+Undercollateralized loan — deflate USDC in Curve, enter/exit vault at manipulated share price
Inverse Finance2022-04-02$15.6MSelf-referential collateral — pump INV via sustained (non-flash-loan) buying, borrow against it
Venus (LUNA)2022-05~$11.2M bad debtStale/paused oracle — Chainlink floor price no longer reflected LUNA’s real collapse
Mango Markets2022-10-11~$116M (SEC figure)Self-referential collateral — pump own MNGO perp mark price, borrow against inflated position

For the TWAP-under-PoS guard example from §3, with OBSERVATIONS = 8, SKIP = 2, MAX_OUTLIERS = 4: an attacker must control enough consecutive block-proposal opportunities to inject more than 4 manipulated price observations within the 16-slot observed range (OBSERVATIONS×SKIPOBSERVATIONS \times SKIP), meaning roughly 6–8 blocks of sustained influence at minimum — a bar that was effectively unreachable for a single actor under Proof-of-Work but is explicitly named as newly plausible for a large staking pool under Proof-of-Stake (ethresear.ch/t/15010, 2023-03).

5. Where it’s used

Section titled “5. Where it’s used”

Ethereum

Section titled “Ethereum”
  • bZx / Fulcrum — the original undercollateralized-loan exploit template (February 2020), predating “flash loan attack” as common vocabulary.
  • Harvest Finance — vault share-price oracle manipulated via a Curve pool (October 2020).
  • Inverse Finance / Anchor — governance-token self-referential manipulation (April 2022); exploited again later in 2022, underscoring that one incident rarely resolves a protocol’s oracle risk.
  • Venus Protocol — Chainlink LUNA/USD floor-price staleness exploited during the Terra collapse (May 2022); Venus suspended the LUNA market via its PauseGuardian multisig.
  • Ethereum consensus-layer research — the enshrined-feed/dual-token debate (2020) remains unresolved; see /oracles/push-vs-pull-vs-twap/.

Solana

Section titled “Solana”
  • Mango Markets — the largest single loss in this set (~$116M, as of 2022-10) and the only Solana entry. Eisenberg’s conviction for fraud and market manipulation was later overturned on appeal (as of 2025-06); the Mango DAO had already let him keep $47M after he returned $67M.
  • Pyth-native oracle usage on Solana lending/perp protocols — Mango’s self-referential-collateral risk generalizes to any Solana protocol hosting a market for its own governance/margin token while treating that market’s price as authoritative.
  • n/a — no Solana-native “enshrined at consensus layer” oracle proposal documented in sources.

6. Risks, attacks, and incidents

Section titled “6. Risks, attacks, and incidents”

This page’s content is the incident catalog above; cross-cutting lessons:

  • Any contract-internal ratio derived from a manipulable pool is an unlabeled oracle. The yVault BPT-redemption bug samczsun documented extends well beyond explicit “price feed” interfaces.
  • Sustained, non-atomic manipulation is a real threat model, not just flash loans. Inverse Finance’s attacker held manipulated INV for the exploit’s duration rather than borrowing and repaying atomically, so defenses guarding only against same-block patterns are incomplete.
  • A protocol’s own governance or margin token is a uniquely dangerous oracle input, because the attacker can be simultaneously the buyer inflating the price and the borrower benefiting from it, with no independent counterparty needed (Mango, Inverse).
  • Circuit breakers at the oracle layer create blind spots at the protocol layer. A feed that stops updating to avoid an implausible value (Chainlink’s min/maxAnswer bounds) is safer for the feed but dangerous for a consumer that doesn’t check for staleness, as Venus demonstrated.

7. Open problems

Section titled “7. Open problems”
  • Whether Ethereum should enshrine any price feed at all. Unresolved since 2020; Drake’s heuristic — “with sufficient cleverness and effort X will usually work” — is presented as unproven, not settled (ethresear.ch/t/7437, 2020-05).
  • Median vs. TWAP as the safer default under PoS. No consensus: median resists single-block manipulation better, but Buterin’s “snap” critique shows it can be more exploitable once an attacker controls roughly half the window.
  • How to prevent self-referential collateral attacks structurally, rather than case-by-case. No source proposes a general fix distinguishing “price set independently of the borrower” from “price partly set by the borrower’s own activity.”

8. Ethereum vs Solana

Section titled “8. Ethereum vs Solana”
AspectEthereumSolana
Documented major incidents in this setbZx, Harvest, Inverse Finance, Venus (4 of 5)Mango Markets (1 of 5, but the largest by dollar amount)
Dominant mechanism observedMix of undercollateralized-loan, self-referential, and stale-oracle failuresSelf-referential collateral via own perpetual/margin token
Protocol-level enshrinement debateActive but unresolved since 2020 (beacon-chain price feed, dual-token oracles)Not documented in these sources
PoS-specific manipulation research (TWAP under multi-block validators)Directly applicable; motivated by Ethereum’s post-Merge validator concentrationNot the subject of the reviewed research; Solana’s consensus differs

Solana’s single entry is also its largest by dollar value, and followed the self-referential pattern rather than Ethereum’s classic flash-loan-and-reverse pattern — “which chain” matters less than whether a protocol lets one actor be both the price-setter and the price-taker for the same collateral.

9. Reference doc

Section titled “9. Reference doc”

The reference

Section titled “The reference”

So you want to use a price oracle — samczsun, 9 November 2020. paradigm.xyz/writing/so-you-want-to-use-a-price-oracle

Summary of the reference

Section titled “Summary of the reference”

The post opens by distinguishing two categories of on-chain price oracle: off-chain-sourced (a handful of privileged parties push external price data on-chain, trusted not to lie or be coerced) and on-chain-sourced (a contract reads a decentralized exchange’s own instantaneous price, trusting only that the market is sufficiently liquid and hard to move). It works through five real case studies in order of increasing sophistication. The Synthetix sKRW incident (June 2019) shows an off-chain oracle failure: a single malfunctioning upstream price feed, compounded by additional system errors, let a trading bot earn over $1B in paper profit before Synthetix negotiated a return. The “undercollateralized loans” case study — samczsun’s own earlier 2019 research — introduces the on-chain-sourced failure mode with a worked example: an attacker who can move a DEX’s spot price within a single transaction can deposit collateral, borrow against the manipulated price, and reverse the trade, extracting value with no real collateral ever backing the loan. Synthetix’s later MKR manipulation (December 2019) shows the two categories can blur together, when an “off-chain” feed turns out to be reading an on-chain price with insufficient liquidity to resist the same trick. The bZx (February 2020) and Harvest Finance (October 2020, over $33M) cases apply the identical undercollateralized-loan template against real lending and yield protocols. A sixth case, the yVault BPT bug, generalizes the lesson further: an oracle doesn’t need to be labeled as one to be exploitable — any contract-internal ratio derived from a manipulable pool’s momentary state qualifies.

The post’s second half is prescriptive. It recommends against integrating illiquid (“shallow”) markets at all; suggests using actual executed swaps rather than a quoted spot price wherever a protocol’s design allows it; proposes “almost decentralized” oracles that only update on a delay controlled by a small trusted group, trading decentralization for manipulation-resistance; suggests a minimum one-block delay between entering and exiting a system to blunt same-transaction manipulation, while noting this both hurts composability and becomes less effective if the attacker can secure guaranteed block inclusion via a cooperating miner; and closes with two mainstream solutions — Uniswap V2’s on-chain TWAP oracle, and “M-of-N reporter” designs (Maker’s price feeds, Compound’s Open Oracle, Chainlink) — while cautioning that both delegate trust somewhere, either to liquidity depth and time, or to a set of named reporters.

Key quotes

Section titled “Key quotes”

“It’s currently late 2020 and unfortunately numerous projects have since made very similar mistakes, with the most recent example being the Harvest Finance hack which resulted in a collective loss of 33MM USD for protocol users.” (Introduction)

“The spot price on a decentralized exchange may be wildly incorrect during a transaction… an attacker has almost full control over the price during a transaction and trying to read that price accurately is like reading the weight on a scale before it’s finished settling.” (Undercollateralized Loans)

“This incident shows that price oracles are not always conveniently labelled as such, and that developers need to be vigilant about what sort of data they’re ingesting.” (yVault Bug)

“For large pools over a long period of time with no chain congestion, the TWAP oracle is highly resistant to oracle manipulation attacks. However, due to the nature of its implementation, it may not respond quickly enough to moments of high market volatility.” (Time-Weighted Average Price)

How to read the original

Section titled “How to read the original”

Background needed: what collateralization ratio and liquidation mean in a lending protocol, and roughly how a constant-product AMM’s price responds to a large trade (see /exchange/cfmm-math/ if unfamiliar). Skip the Synthetix sKRW section on a first pass if your focus is DEX-price manipulation specifically — it’s an off-chain-feed failure with a different root cause than the rest of the post. The hardest part to internalize is the yVault case: it’s tempting to read it as “a bug in a yield vault,” but the actual lesson is structural — any on-chain value computed as a ratio against a pool’s live reserves is a de facto price oracle, whether or not the code that reads it calls itself one, which is why the incident catalog in this page’s §3 includes examples (Mango, Inverse) where the “oracle” was a protocol’s own market for its own token rather than a labeled external feed.

What changed since

Section titled “What changed since”
  • The two later incidents this page covers that postdate the post (Inverse Finance 2022, Mango Markets 2022, Venus 2022) all confirm its central thesis rather than requiring revision — Mango and Inverse extend the pattern to a protocol’s own governance/margin token, a variant samczsun’s five 2019–2020 case studies don’t individually cover but whose underlying lesson (“any manipulable ratio is an oracle”) already predicts.
  • TWAP, this post’s own recommended mitigation, is itself the subject of the PoS-specific manipulation research summarized below, which postdates and partially qualifies its “highly resistant… for large pools over a long period” claim.
  • Chainlink’s Smart Value Recapture (SVR) feeds (2026, see /oracles/push-vs-pull-vs-twap/) are a direct descendant of this post’s “M-of-N Reporters” category, adding an economic mechanism the 2020 post did not yet have available to recommend.

The reference

Section titled “The reference”

Enshrined Eth2 price feeds and Counter-proposal to enshrined price feeds: dual-token oracles — Justin Drake and Vitalik Buterin, 11 and 16 May 2020. ethresear.ch/t/7391 · ethresear.ch/t/7437

Summary of the reference

Section titled “Summary of the reference”

Drake’s proposal adds a price_data field to every beacon block body, structurally identical to graffiti in that the state-transition function and fork-choice rule both ignore its content entirely — honest validators are expected to populate best-effort prices for a small set of tracked fiat currencies at every epoch boundary (6.4-minute granularity), snapshotting the last several values so a downstream contract can take a median across up to 256 beacon-block contributions per epoch as an honest-majority oracle. The proposal frames this as low-cost infrastructure — marginal bandwidth overhead, no consensus-rule changes — governed by social norms (minimum viable asset set, rough consensus for additions, backward compatibility for removals) rather than on-chain governance, with misbehavior deterred only by social shaming, social slashing via coordinated hard fork, or social orphaning of dishonest validators’ blocks.

Buterin’s reply rejects the proposal on two grounds. First, architecturally: Ethereum’s defining property is that block validity is fully and deterministically verifiable, while a price has no such objectively checkable ground truth — introducing a field whose “correctness” the protocol cannot verify even in principle is a categorically different kind of addition than anything else in the beacon chain, and he notes pointedly that a country’s exchange rate could even become contested (e.g., a civil war producing two competing “real” governments) with no protocol-legible resolution. Second, on trust assumptions: enshrining a feed relies on honest-majority validator behavior exactly where much of the rest of Eth2’s design (proof of custody, and other “second lines of defense”) is explicitly trying to move away from pure honest-majority reliance. His counter-proposal, dual-token oracles, requires a participant to hold both an active 32-ETH validator slot and a stake of a separate, purpose-built oracle token to take part in a global coin-vote reporting mechanism modeled on existing oracles like Augur, Kleros, and UMA — combining the enshrined proposal’s high budget (a large amount of value is needed to attack) with the token-based oracles’ high cost (a slashable stake whose loss is the direct penalty for incorrect reporting), which neither design alone achieves on its own. The two authors do not converge in the visible reply thread: Drake pushes back with a general heuristic that sufficiently clever pure-ETH incentive mechanisms (application-layer slashing, small plausibly-deniable validator biases treated as legitimate extractable value) might substitute for a separate token, while Buterin maintains that incentivizing correct reporting of “some real fact about the world” fundamentally requires a token whose value the base protocol does not and should not need to understand.

Key quotes

Section titled “Key quotes”

“The service allows building fully decentralised oracles that produce a price for every tracked asset at every epoch boundary, i.e. with a granularity of 6.4 minutes.” (Enshrined Eth2 price feeds, Construction/TLDR)

“This proposal, on the other hand, aims to introduce a property of the chain that cannot be programmatically verified under any assumption even in principle.” (Reply #4, Vitalik Buterin)

“These oracles have a budget requirement and cost of attack roughly equal to the market cap of the oracle token… The goal of this proposal is to combine these two systems, creating a system with a budget requirement consisting of a substantial portion of all staked ETH plus an oracle token, and a cost of attack based on the oracle token.” (Counter-proposal, dual-token oracles)

“I think fundamentally yes (for oracles, not for most dapps), precisely because tokens are the only robust way to provide incentives for correct reporting.” (Reply #3, Vitalik Buterin)

How to read the original

Section titled “How to read the original”

Background needed: what an epoch boundary and a beacon block are in Ethereum’s post-Merge consensus, and a rough sense of Eth2’s “honest majority” security-model assumptions generally. Skip the detailed PriceData container field layout (byte sizes, rounding rules) on a first pass — it’s an implementation sketch, not the substantive argument. The hardest paragraph is Vitalik’s civil-war example (two competing governments both claiming to be the “real” issuer of a fiat currency): it can read as a contrived edge case, but the actual point it makes is general — any system that requires the protocol to adjudicate an external, non-cryptographic fact is exposed to disputes the protocol has no native mechanism to resolve, no matter how rare the specific triggering scenario.

What changed since

Section titled “What changed since”
  • No enshrined price feed has shipped in Ethereum’s protocol as of these sources; the debate remains a design-space marker rather than a resolved question.
  • TWAP-under-PoS research (ethresear.ch/t/15010 and /t/12778, both 2022–2023) revisits the same underlying worry — that honest-majority or low-collusion-cost assumptions about block production can erode oracle safety — from the opposite direction: instead of proposing a new enshrined mechanism, it hardens the existing on-chain TWAP/median approach against exactly the kind of validator concentration Buterin’s 2020 reply worried about generally.
  • Chainlink’s Smart Value Recapture (SVR) feeds (see /oracles/push-vs-pull-vs-twap/) represent a market-driven answer to a related concern — value extractable around oracle updates — that neither 2020 proposal anticipated in this specific form.

Secondary references

Section titled “Secondary references”
  1. TWAP oracle extension to mitigate the risk of oracle manipulation under PoS (Averageuser404, ethresear.ch, 2023-03) — read for the concrete outlier-detection guard design and gas-cost estimate used in this page’s §3 and §4.
  2. Median prices as alternative to TWAP (hoytech, ethresear.ch, 2022-06) — read for the median-vs-TWAP debate and Vitalik’s “snap” critique of median oracles under multi-block attacker control.
  3. Improved Price Oracles: Constant Function Market Makers (Angeris & Chitra, arXiv, 2020-03) — read for the formal arbitrage-driven argument for why CFMM prices track reality between transactions, which is the assumption every incident on this page defeats during one.

10. Sources

Section titled “10. Sources”