Cowrie Research

stale-price-exploitation

17 min read

Stale-Price Exploitation / Feed-Liveness Failure

  • Name: Stale-price exploitation / feed-liveness failure
  • Category: exploit pattern / oracle-liveness failure / stale-feed collateral overvaluation / fail-open risk-management bug
  • Summary: Stale-price exploitation happens when a protocol keeps honoring an old oracle answer after the referenced market has already moved somewhere else, or keeps honoring an old price meaning after the collateral object no longer deserves it. The attacker does not need to manipulate the oracle directly if the protocol is already lending, liquidating, or settling against a dead price. The recurring design mistake is collapsing three different decisions into one vague the feed still has a number: some last published answer exists, that answer still deserves to count as live solvency or wrapper-price truth, and that surviving truth still deserves fresh borrow, liquidation, or settlement authority right now. The exploit surface is the gap between last published answer and current executable value, especially when a feed freezes behind a heartbeat window, trips a circuit breaker, loses a source, or when a wrapper / receipt token keeps inheriting an underlying price semantics that upstream compromise has already destroyed.
  • What it is:
    • A protocol relies on an onchain oracle answer to decide collateral value, borrow limits, liquidation eligibility, or settlement prices.
    • The upstream feed stops updating, updates too slowly for current volatility, or keeps publishing an answer that is no longer economically current.
    • The downstream protocol continues treating that stale answer as live solvency truth instead of quarantining the market.
    • The attacker acquires the now-mispriced asset or targets accounts affected by the stale answer.
    • Real value is extracted by borrowing stronger assets, escaping liquidation, forcing bad liquidations, or settling positions against a dead mark.
  • Typical preconditions:
    • The oracle updates only when deviation or heartbeat thresholds are met, so freshness is bounded rather than continuous.
    • The protocol checks answer but not enough about updatedAt, cross-market plausibility, or whether the feed has effectively halted during stress.
    • Borrowing, liquidation, or settlement remains permissionless while the stale answer is live.
    • The affected collateral or liability can be sourced or offloaded cheaply in external markets that have already repriced.
    • Circuit breakers, minimum-answer guards, exchange halts, or source outages can freeze the feed at a value the downstream protocol still honors.
  • Common vulnerable surfaces:
    • lending markets that keep accepting a collapsing asset as collateral while its oracle is frozen above reality
    • liquidation engines that seize collateral or debt against a stale answer during a fast repricing event
    • perps or derivatives venues that let unrealized PnL persist against a dead index price
    • fallback trees that quietly keep the last good value without changing market permissions
    • wrappers, LSTs, or bridged receipt assets that keep inheriting an underlying feed’s price semantics after issuer compromise, depeg, redemption failure, or upgrade-boundary collapse
    • protocols integrating third-party feeds without a local freshness or pause layer tied to the protocol’s own risk appetite
  • Exploit sequence:
    1. A market dislocation, source outage, circuit breaker, or update-threshold lag leaves the oracle answer behind real market prices.
    2. The protocol keeps borrowing, liquidation, or settlement paths open.
    3. The attacker buys or borrows the now-cheap asset, or targets positions that the stale answer misclassifies.
    4. They submit the asset or position into the target protocol while the stale answer still grants excess value or blocks needed liquidation.
    5. The protocol honors the stale price as if it were current.
    6. Once the feed catches up or the market is paused, the protocol is left with bad debt, unjust liquidations, or an already-drained reserve base.
  • Variants:
    • Crash-collateral overvaluation — a collapsing asset remains accepted as collateral above realizable market value, letting attackers borrow out stronger assets before repricing.
    • Stale-debt undervaluation — a liability asset is priced below reality long enough to let users repay too cheaply or avoid liquidation.
    • Frozen-liquidation mark — a stale mark makes healthy accounts look liquidatable or insolvent accounts look healthy.
    • Circuit-breaker fail-open — the oracle’s own safety stop freezes updates, but the downstream protocol fails open and treats the frozen answer as still tradable collateral truth.
    • Heartbeat-gap exploitation — the feed is technically operating as designed, but the protocol’s risk model assumes the heartbeat is fast enough for the asset’s stress regime when it is not.
    • Semantic-staleness / wrapper-meaning invalidation — the underlying feed may still be live, but the protocol keeps pricing a wrapper, receipt token, or derivative as if it still inherited the old underlying semantics after issuance integrity, redemption parity, or upgrade trust has already failed upstream.

Three stale-state promotions healthy systems should not collapse

  • Answer existence — some last published number exists onchain, or some fallback / last-good answer is still reachable. That alone does not prove the price is still current enough for this market or this wrapper.
  • Continued price meaning — the protocol decides that this number still deserves to count as live solvency truth for the exact collateral object in question. This is where stale-feed cases and semantic-staleness cases meet: even a numerically fresh underlying feed may no longer describe a wrapper whose redemption, issuance, or upgrade integrity already failed.
  • Downstream authority budget — even if a cautious market mode keeps a stale or semantically wounded mark around for repayment, unwind, or user communication, that is still a smaller decision than allowing fresh borrowing, liquidation, settlement finality, or new balance-sheet expansion against it.
  • Healthy designs force reviewers to answer all three questions separately: is there still a number?, does it still mean what we think it means for this asset?, and what exact actions may still rely on it right now?
  • Detection heuristics:
    • Treat updatedAt and feed-specific heartbeat/deviation settings as solvency inputs, not just metadata.
    • Compare the protocol’s oracle answer to executable external prices during stress; the dangerous question is not is the feed honest? but is it current enough for this market?.
    • Ask what the protocol does when the feed stops moving while the market still is.
    • Ask a second question in wrapper systems: even if the feed is fresh, does this collateral object still deserve that feed’s semantics at all after an upstream compromise, depeg, paused redemption, or broken issuance path?
    • Check whether risk controls fail closed: disabling borrowing, tightening collateral factors, or pausing liquidations when freshness assumptions break.
    • Model circuit-breaker behavior explicitly. A frozen answer can be safer for the oracle operator than for the downstream protocol using it.
  • Defenses:
    • Enforce per-asset freshness thresholds using updatedAt and market-specific tolerances rather than one generic oracle-health check.
    • Add discrepancy checks against independent venues or reference feeds before a stale answer can keep underwriting credit.
    • Fail closed on stressed or stale collateral: pause borrowing, reduce collateral factors, or quarantine the market until operators confirm price integrity.
    • In wrapper systems, maintain an explicit de-recognition path for fresh but no longer semantically valid collateral, because a live underlying feed does not save a wrapper whose issuance integrity or redemption meaning has already broken. Wrapper semantic-price revocation and collateral de-recognition is the positive-design companion when the sharper task is defining that emergency state explicitly.
    • Align risk parameters with feed mechanics. Heartbeat and deviation thresholds are part of the protocol design, not external implementation trivia.
    • Treat oracle circuit breakers, source outages, wrapper compromises, and feed deprecations as protocol-level emergency states with predefined pause and unwind paths.

What sound design looks like

  • A healthy oracle integration separates a number still exists from that number still deserves solvency meaning and separates both again from money-moving paths may still spend against it. Long before a stale or semantically broken mark can create new borrow power, liquidation authority, or settlement finality, the market should already have downgraded into a restricted mode that preserves repayment and exit while shutting off balance-sheet expansion. In lending terms, this usually means an explicit repay-only or repay-and-supply-only emergency lane rather than the ambiguous market still technically works state that Venus briefly inherited during the LUNA feed suspension. Exit-only residual-surface discipline is the sharper positive-design companion when the question becomes how to keep that emergency lane real instead of letting it silently drift back into ordinary market permissions.
  • Freshness policy is asset-specific and explicit. The protocol should know, per market, how long a price may stay live under calm conditions, how much tighter that budget becomes during stress, what alternate checks can keep it usable, and what exact actions stop first when those assumptions fail.
  • Wrapper and receipt assets have a separate semantic-validity lifecycle. A sound system can say the feed is still numerically fresh, but this collateral object no longer deserves that feed's meaning and then de-recognize, haircut, or quarantine it without waiting for the upstream oracle itself to go stale. Wrapper semantic-price revocation and collateral de-recognition is the positive-design companion when the sharper task is formalizing that revocation boundary.
  • Fallbacks are treated as temporary unwind rails, not silent credit extensions. If a protocol keeps a last-good price, alternate feed, or operator-confirmed emergency mark alive, the scope and duration of that mode are bounded in advance and paired with progressively stricter market permissions. A good emergency design can say exactly when feeds are zeroed, when collateral factors go to zero, which actions remain open during the repayment window, and when full offboarding begins.
  • Oracle safety is measured against executable exit liquidity, not just feed honesty. Healthy designs continuously ask whether the reported price still corresponds to a realizable market for the asset at the protocol’s own position size, especially when the asset is bridged, wrapped, newly compromised, or structurally dependent on some upstream issuer or verifier.
  • The protocol has a concrete stale-state constitution: who can pause, who can de-recognize a wrapper, what governance or guardian path applies, what users can still do during quarantine, and what telemetry proves the market is safe to reopen. Once a market is in that residual state, healthy operators should also publish it outward as machine-readable withdraw only / no fresh collateral / no fresh routing policy rather than relying on prose and social memory alone. Exit-only status signaling and downstream de-recognition and machine-readable residual-status publication are the downstream-governance companions on that side.

Failure-prevention checklist

  • Write down, per asset, three separate gates: what lets a price stay visible at all, what lets it keep solvency meaning for this exact collateral object, and what lets it continue granting fresh borrow / liquidation / settlement authority. Feed returns a number is not enough.
  • Bind collateral policy to feed mechanics: heartbeats, deviation thresholds, dispute windows, circuit breakers, fallback trees, and source-market trading hours should all map to explicit protocol actions.
  • Fail closed when freshness assumptions break. Freeze fresh borrowing, cap withdrawals, suspend liquidations that rely on the dead mark, or quarantine the market instead of quietly honoring the last answer.
  • Predefine repay-only recovery modes for stale-feed events: zero or derecognize the affected collateral price when needed, set collateral factors to zero where offboarding is required, and keep only the narrow user actions that reduce protocol risk rather than expand it.
  • Treat wrapper and receipt assets as separately revocable collateral meanings. A fresh underlying price does not rescue a wrapper whose issuance integrity, redemption parity, or upgrade trust has already failed.
  • Add independent plausibility checks against executable venues, alternate feeds, or local market-state guards so one frozen answer cannot keep underwriting the same stale balance-sheet fiction indefinitely.
  • Size collateral factors, borrow caps, and liquidation incentives against the asset’s stress-path liquidity and the oracle’s worst-case freshness lag, not its calm-market behavior.
  • Predefine the operator runbook for stale-feed states: who can pause, who can de-recognize a wrapper, what unwind path exists, and what onchain toggles actually close the dangerous actions first.
  • Make fallback design explicit. Last good price is a policy choice that needs a time budget, a scope limit, and a fail-closed end state.
  • Test semantic-staleness branches directly: issuer compromise, bridged-asset depeg, redemption halt, deprecated wrapper, or upgrade-boundary break should all be able to revoke collateral meaning before bad debt is printed.

Audit prompts

  • What exact condition tells this protocol a price is still live enough to back new credit: updatedAt, heartbeat, deviation, cross-check spread, sequencer status, market-hours assumption, or something hand-wavy?
  • Which of the three stale-state promotions stay open after trouble starts: number visibility, solvency meaning, and fresh authority budget? If all three survive by default, the market almost certainly fails open.
  • Which actions remain open after the feed stops moving: fresh borrowing, collateral entry, liquidation, withdrawal, settlement, minting, or only repayment and unwind?
  • If the feed freezes at a favorable number during a fast crash or depeg, how much real value can an attacker remove before any operator or automatic guard intervenes?
  • Does the protocol distinguish fresh but semantically dead from stale but once-valid? Where can a wrapper, bridge receipt, LST, or upgrade-broken derivative lose oracle meaning even if the underlying feed still updates?
  • What fallback path is actually honored when the main feed stalls, and how long can that fallback keep the market live before the protocol must fail closed?
  • If the protocol plans to resume from a stale-feed pause, can it actually enter a repay-only or repay-and-supply-only state, zero collateral factors on the broken market, and stage feed restoration in a way that prevents unpause from meaning instant fresh borrow and liquidation authority again?
  • Are collateral factors, caps, and liquidation parameters sized for the oracle’s real worst-case lag under stress, or for a calm-market update cadence that disappears exactly when the asset breaks?
  • Can attackers choose when the protocol observes an otherwise-valid oracle update, as in delayed relay, congestion, or pull-based oracle systems, and then monetize the stale window against still-open trading or lending paths?
  • If the upstream oracle’s own circuit breaker freezes the answer, does the downstream protocol interpret that as safe to keep using or time to stop extending credit?
  • For wrappers and bridged assets, what exact event revokes inherited price semantics: issuer compromise, mint authority break, redemption pause, bridge verifier failure, or governance-announced deprecation?
  • If this stale-price condition became public now, what concrete controls stop further loss first: automatic market pause, manual guardian action, haircut escalation, borrow disablement, or nothing until users react?

Lessons that should already be standard

  • Stale prices are not passive data-quality bugs. Leaving borrowing or settlement live against an old mark is an affirmative credit decision.

  • Repay-only is a smaller authority budget than still valid collateral truth. Healthy systems deliberately preserve those as different states instead of jumping straight from feed exists to market fully live.

  • A feed heartbeat is part of the collateral contract, not an implementation footnote. If the market can break faster than the heartbeat, the protocol is under-secured.

  • Last good price is only safe if the protocol also says last good for what, and for how long? Without scope and timeout, it becomes silent leverage.

  • Wrapper collateral can become semantically dead before it becomes numerically stale. Fresh upstream prices do not save downstream systems that failed to revoke a broken wrapper’s inherited meaning.

  • Oracle circuit breakers protect oracle operators first. Downstream protocols still need their own fail-closed credit policy once the feed stops reflecting executable reality.

  • The oracle safely froze is not the same thing as the protocol safely stopped extending credit. A suspended feed plus still-live borrow authority is just a stale-price exploit window with nicer wording.

  • Liquidation, borrowing, and settlement do not have to share the same stale-feed behavior. Good designs separate let users unwind from let users keep minting risk.

  • A protocol that cannot say exactly who pauses, who de-recognizes, and what path stays open during stale-feed states has not really designed its oracle layer.

  • Many stale-price exploits are really semantic-recognition failures wearing liveness clothes: the system kept honoring a once-valid meaning long after the asset stopped deserving it.

  • High-signal incidents:

    • Venus Protocol LUNA stale Chainlink price exploit (2022-05-12) — the cleanest preserved exemplar in this corpus: Chainlink’s BNB Chain LUNA / USD feed froze around $0.107 during the Terra collapse, Venus left the market live for hours, and attackers deposited roughly 230M LUNA before borrowing about $13.5M of stronger assets.
    • Helio Protocol aBNBc stale-BNB-oracle bad-debt exploit (2022-12-02) — after Ankr’s privileged-upgrade compromise made aBNBc economically worthless, Helio still treated the wrapper through BNB oracle semantics, so about 10 BNB could buy enough depegged aBNBc to borrow 16M HAY and export the damage through Wombat liquidity.
    • congestion-liveness exploit (2023-12-26) — a good perps-market exemplar where the feed was still authentic but the attacker could choose when valid Pyth VAAs became protocol-visible, then amplify that edge by starving competing oracle updates and user flow during congestion.
    • Oracle manipulation remains the broader family because stale-price exploitation is often economically equivalent to a manipulation attack: the protocol still honors a price that cannot actually clear at size, only the failure mode is liveness rather than direct market printing.
    • Oracle configuration failure is the adjacent self-inflicted cousin: there the protocol publishes the wrong price because its own composition logic is wrong, while stale-price exploitation begins with a once-valid answer that should have stopped underwriting live credit.

Where this pattern stops

  • Stay here when the downstream protocol’s decisive mistake is we kept honoring a once-valid price or once-valid price *meaning* after its freshness or semantic validity had expired.
  • Use wrapper semantic-price revocation and collateral de-recognition when the sharper design question is how a downstream protocol should revoke a wrapper’s inherited oracle meaning once upstream integrity has already failed.
  • Narrow to oracle-configuration failure when the protocol itself composed, normalized, or bound the price path incorrectly even though the collateral object still deserved a live price in principle. Rho, Tender, Morpho, Moonwell, and Aave CAPO are the cleaner self-authored-price cousins.
  • Narrow to oracle-manipulation when the exploiter’s main leverage is still actively printing or pushing the live market price rather than waiting for a dead or semantically expired price to keep its privileges.
  • Narrow to privileged-upgrade abuse or signer-quorum compromise when the sharper lesson is the upstream asset-definition failure itself. Ankr aBNBc belongs there because the receipt token became counterfeit at the upgrade boundary; Helio aBNBc belongs here because the downstream lending venue kept honoring the old BNB price meaning after that upstream break.
  • Narrow toward donation-share-price-manipulation, lp-token-oracle-mispricing, or protocol-native-collateral-fragility when the dangerous mark is still live but cheaply printable through local wrapper, LP, or house-asset market state rather than stale or semantically dead oracle truth.

Internal linkages

Control surface

  • The decisive leverage sits in feed freshness thresholds, semantic-validity revocation, pause policy, collateral admission, fallback behavior, circuit-breaker handling, and the authority budget granted to stale or emergency marks over time.
  • The mistake is not merely the oracle was stale. The real failure is balance-sheet design that keeps treating last answer exists, last answer still means this asset, and last answer may still authorize live risk as if they were the same question.

Sources

Last reviewed

  • 2026-08-02 UTC

Graph View

Backlinks