Oracle Manipulation & Flash Loans
If a protocol trusts a price it can be tricked about, an attacker can bend that price for one instant — often with borrowed millions — and rob it.
Lesson 15 taught the oracle problem: a blockchain can’t see the outside world, so protocols rely on oracles to feed in facts like prices — and they can only be as trustworthy as that feed. Now we weaponize that idea. A huge share of DeFi hacks aren’t reentrancy (last lesson) — they’re oracle manipulations: the attacker doesn’t break the math, they feed the protocol a lie about a price and let its own correct logic hand over the funds. And a uniquely crypto tool makes it terrifyingly accessible. Hold the question: if a lending protocol trusts a price to decide how much you can borrow, what happens if you can move that price for a single transaction?
The attack: lie about the price, let the logic pay out
Oracle manipulation is when an attacker distorts the price a protocol reads, so the protocol’s own honest logic makes a ruinous decision. The classic target is a protocol that reads its price straight from a single on-chain market’s spot price — the current price in one trading pool right now. Recall from lesson 25 that a big trade on an AMM has price impact: it moves that pool’s price. So an attacker with enough money can shove a pool’s price way up or down for a moment, and if a lending protocol is reading that exact pool as its “truth,” it now believes a false price — and will, say, let the attacker borrow far more against their collateral than it’s really worth. The contract did nothing “wrong”; it was fed a lie.
Flash loans: renting millions for one transaction
You’d think this needs a whale’s fortune. Here’s the twist that makes it accessible to anyone: the flash loan. Remember that everything in one transaction either all succeeds or all reverts (a property from how transactions work). A flash loan exploits this: it lets you borrow a massive amount with no collateral, on the condition that you repay it within the *same transaction — because if you don’t repay by the end, the whole transaction reverts as if nothing happened, so the lender is never at risk. That means an attacker can borrow millions* for a few lines of code: use the borrowed millions to manipulate the price, exploit the fooled protocol, repay the loan, and pocket the difference — all atomically, with almost no starting capital. Flash loans are a legitimate tool, but they turn “needs a fortune” attacks into “needs a good idea” attacks.
A flash-loan oracle attack, in one transaction: • Borrow $50M via a flash loan (no collateral, must repay by transaction’s end). • Dump it into a thin AMM pool to crash (or spike) the price of some token that a lending protocol reads as its oracle. • With the price now distorted, exploit the protocol — e.g. borrow far more than your real collateral should allow, or trigger a mispriced liquidation. • Repay the $50M, keep the profit. If any step fails, the whole thing reverts and the attacker loses only gas.
The defense: don’t trust a price you can move cheaply
The root cause is trusting a price that’s cheap to manipulate for an instant. The fixes all raise the cost of lying. Use a time-weighted average price (TWAP) — the average over a window of time rather than the instantaneous spot — so a one-block spike barely budges it (to move an average, you must hold the price off for a long time, which is hugely expensive). Pull from multiple independent sources and aggregate, so no single pool is the truth. Use deep, liquid markets whose price is costly to shove. This connects the whole module: a protocol is only as safe as the weakest input it trusts, and a naive spot-price oracle is a trapdoor under otherwise-solid code. The audit question (next lesson) is always: what does this protocol trust, and how expensive is it to fool?
Imagine a pawnshop that decides your loan by glancing at the price of an item on one auction website at the exact second you walk in. A schemer could place a single absurd bid to make that item look worth $1M for one moment, walk in, borrow $1M against a worthless trinket, and vanish. Now add flash loans: it’s as if the schemer could borrow the million needed to place that fake bid, do the whole scam, and repay it seconds later — risking nothing. The pawnshop wasn’t robbed by force; it was fed a fake price. The fix is to price items by their average value over time across many markets, so no single fake bid can move the number.
Fragile vs robust oracle design: 1. Fragile: a lending protocol reads the spot price from one thin AMM pool. A flash-loan attacker moves that pool’s price for one block and drains the protocol. 2. Robust: the protocol uses a TWAP over many minutes from several deep markets. A one-block spike barely nudges the average, and moving it for minutes across all sources would cost more than any profit. 3. Same protocol logic — only the price source differs — and that choice is the whole security boundary. 4. The audit lens: “how much would it cost to move the price this protocol trusts?”
This is the reading. The interactive version — active-recall quiz, a hands-on experiment you run in your own AI, and an earned mastery check — is free in the app.
Start this lesson free →