Cowrie Research

vault-strategy-path-valuation-manipulation

15 min read

Vault Strategy-Path Valuation Manipulation / Execution-Path Oracle Failure

  • Name: vault strategy-path valuation manipulation / execution-path oracle failure
  • Category: exploit pattern / vault-accounting oracle manipulation / strategy-routing valuation failure / share-pricing execution-path abuse
  • Summary: Some vaults do not just hold an asset and mark it with an external oracle. They decide share issuance, share redemption, or controller-side inventory value from the live execution path through an AMM or pooled strategy: current Curve imbalance, current 3pool composition, or a hypothetical unwind route through today’s spot state. That turns the strategy path itself into the oracle. The attacker then skews that market state, chooses the exact block when the vault routes funds through it, or forces the vault to value its inventory as if a poisoned unwind quote were real reserve value. The payoff is not necessarily borrow against fake collateral; often it is simpler and nastier: mint vault shares too cheaply, redeem them too richly, or make the vault hand out real idle liquidity against a non-realizable mark.
  • What it is:
    • A vault, controller, or strategy adapter values invested assets from live pool state or a spot unwind / deposit path.
    • That valuation directly affects vault-share minting, vault-share burning, or withdrawal accounting.
    • The attacker can temporarily distort the referenced pool or choose when the vault consumes that distorted state.
    • The vault honors the manipulated execution-path value as if it were durable reserve truth.
    • The attacker extracts the spread by entering during the bad state and exiting after normalization, or by redeeming against a hypothetical liquidation value the vault never really realizes.
  • Typical preconditions:
    • The vault’s share-pricing path depends on current AMM pool composition, virtual price, raw reserve state, or a controller-side what could we unwind for right now? helper.
    • Deposits, withdrawals, earn(), rebalance calls, or controller accounting updates are permissionless or attacker-timable.
    • Slippage checks, arbitrage thresholds, or strategy-entry guards are too loose for the manipulated venue depth.
    • The attacker can restore the pool or otherwise separate entry pricing from exit payout before the protocol notices.
    • The vault has an idle buffer or withdrawable strategy inventory, so it can pay out against a normalized or hypothetical value without forcing the exact poisoned unwind that created the mark.
    • The protocol treats shared-pool spot conditions or freshly changed local reserve composition as fair share-accounting truth even when flash liquidity can move them violently.
  • Common vulnerable surfaces:
    • vaults whose underlyingBalanceWithInvestment() or equivalent share-pricing helper depends on current pooled-strategy value
    • controllers that price heterogeneous strategy inventory through same-block hypothetical conversion routes
    • v1-style earn() or harvest entrypoints that let any caller choose when fresh deposits hit the strategy path
    • vaults that mint and burn shares against different legs of the same manipulable shared pool within one short loop
    • withdrawal systems that pay from local buffers while share pricing still references manipulated invested balances
    • stable-swap strategy wrappers that implicitly treat current pool imbalance as fair reserve value
  • Exploit sequence:
    1. The attacker acquires enough capital to skew the underlying shared pool or AMM.
    2. They distort the pool state, often by making one coin scarce or expensive inside the strategy venue.
    3. While that state is live, they trigger the vault action that consumes it: deposit, earn(), withdraw, or controller valuation.
    4. The vault mints shares too cheaply, routes assets into the bad market, or overstates what existing strategy inventory is worth.
    5. The attacker then restores or partly restores the pool, or simply redeems against real vault liquidity that was priced from the manipulated mark.
    6. The protocol pays out real assets against a valuation that only existed because the attacker temporarily controlled the execution path.
  • Variants:
    • Entry-side discounted minting — the attacker skews the strategy venue so a deposit buys vault shares at an artificial discount, then redeems after the venue normalizes, as in Harvest.
    • Permissionless strategy-forcing — the attacker not only skews the venue but also chooses exactly when the vault pushes fresh assets into it, as in Yearn V1 earn().
    • Same-path reserve publication — the vault’s own invest / deposit path changes local reserve state and then immediately reuses that same state as share-price truth for minting or withdrawal, as in OneRing.
    • Exit-side hypothetical unwind overvaluation — the vault overpays on redemption because controller logic prices strategy inventory through a poisoned unwind route that the vault never truly executes, as in Value DeFi.
    • Buffer-backed extraction — the vault’s local liquidity buffer lets the attacker redeem at a normalized or hypothetical share price without making the manipulated venue absorb the actual payout.

Three execution-path valuation promotions reviewers should not collapse

  1. Some strategy-path market state exists

    • A Curve imbalance, LP reserve mix, concentrated-liquidity state, or one-sided unwind quote is visible right now.
    • That only proves the route currently looks like this.

  2. That transient route state counts as canonical vault inventory truth

    • The harder question is whether this exact execution-path observation deserves to become share-price, NAV, or controller inventory truth for the whole vault.
    • Most incidents in this family fail here: the protocol promotes a cheap-to-shape route condition into money-good reserve value before proving it is durable or realizable.

  3. That accepted valuation truth deserves this much mint / redeem / reserve-spend authority right now

    • Even if a route-dependent mark is informative, it should not automatically inherit full share-issuance, full redemption, or deep-buffer payout authority in the same economic window.
    • This is where delayed publication, bounded authority, and reserve-spend separation matter.

Healthy vault review gets materially better once teams stop flattening those three promotions into one vague moment called the strategy was worth X.

  • Boundary tests that keep this pattern sharp:
    • Classify it here when the vault’s own share-accounting or controller valuation path is the main oracle surface. If the preserved lesson is the strategy execution path itself set vault truth, this note should do the analytical heavy lifting.
    • Classify it under lp-token-oracle-mispricing when the decisive consumer is mainly treating an LP or BPT token as collateral, reward NAV, or borrowable value. There the sharper mistake is this receipt token is worth X; here the sharper mistake is this vault's own entry / exit / inventory accounting trusted current execution-path state.
    • Classify it under read-only reentrancy when the false price only existed during an unfinished callback window. Harvest, Yearn, and Value used ordinarily settled but manipulable spot state, not mid-transition callback state.
    • Classify it under donation-share-price-manipulation when the attacker prints wrapper value by donating assets or exploiting share-accounting asymmetry rather than by forcing the vault to trade or value itself through a bad market state.
    • Classify it under oracle-manipulation when no vault-share accounting seam matters and the protocol simply borrows against a thin printed market price.
  • Detection heuristics:
    • Trace the exact function that decides how many shares a deposit mints and how many assets a redemption burns into. Ask which live market state it trusts.
    • Look for helpers that answer hypothetical liquidation questions like what would all strategy assets be worth in base asset right now? and check whether withdrawals can be paid without actually executing that unwind.
    • Stress-test the strategy venue under large temporary imbalance and compare minted shares, redeemed assets, and reported invested balance before and after normalization.
    • Treat permissionless strategy-entry calls like earn() as oracle-timing surfaces, not harmless maintenance verbs.
    • Ask whether the vault can mint against one venue state and redeem against another while the protocol still internalizes the spread.
    • Check whether idle buffers or cached invested-balance reads let the vault pay real value without forcing the exact market path its accounting imagined.
  • Defenses:
    • Separate vault-share accounting from attacker-timable spot execution paths wherever possible.
    • Use delayed, averaged, or manipulation-resistant valuation for invested strategy inventory instead of same-block shared-pool state.
    • Restrict who can force strategy entry or rebalance timing, especially for legacy earn()-style flows.
    • Tighten slippage and arbitrage bounds around strategy-entry and strategy-exit accounting, not just swap execution.
    • Make withdrawal accounting prove realizable reserve value rather than hypothetical best-effort unwind value through a manipulated venue.
    • Treat vault buffers as part of the oracle boundary: if a buffer lets users redeem against a mark they never force the strategy to realize, the buffer amplifies oracle risk.
    • Audit vault, controller, strategy adapter, and venue assumptions together; the exploit surface crosses all of them.

What sound design looks like

  • Vault share-accounting truth is anchored to settled, realizable asset value rather than to whichever AMM route, Curve imbalance, or hypothetical unwind quote happens to look best right now. Execution pricing and accounting pricing are separate on purpose.
  • The protocol treats strategy-entry timing, rebalance timing, and AUM publication timing as privileged economic control. A permissionless caller cannot cheaply decide when a manipulable venue state becomes canonical share price or controller NAV.
  • The design keeps route state observed, valuation published, and reserve authority granted as separate stages. A route-dependent quote or reserve mix may be visible immediately, but it does not become full-size mint or redeem authority until slower validation or bounded publication says it can.
  • Deposits and withdrawals are symmetric with respect to trusted valuation state. Users do not get to mint against one venue condition and redeem against another while the vault internalizes the spread through buffers, stale invested-balance helpers, or hypothetical unwind math.
  • Idle buffers, controller abstractions, and helper quotes are included in the oracle boundary instead of being treated as operational convenience layers. If a buffer lets the vault pay out without forcing the marked strategy unwind, that buffer must not silently monetize a dirty mark.
  • Strategy inventory recognition is delayed, capped, or smoothed whenever the underlying venue can be flash-skewed or one-sided. The design admits that some route-dependent values are too attacker-timable to become immediate accounting truth.
  • A healthy vault can answer one blunt question at all times: what exact market fact mints shares here, and could an outsider cheaply rewrite that fact for one block? If the answer is fuzzy, the valuation path is already too execution-coupled.

Failure-prevention checklist

  • Write down the exact objects allowed to define share-accounting truth: idle balances, invested balances, unwound quote helpers, pool virtual prices, controller AUM, or strategy-specific reserve reads. Remove any ambiguity about which live execution-path state can mint or burn shares.
  • Keep share issuance and redemption formulas independent from same-block, attacker-timable venue state wherever possible. If a strategy route can be manipulated cheaply, it should not also be the canonical accounting oracle.
  • Make strategy-entry timing privileged or at least rate-limited when the route depends on thin or imbalance-sensitive venues. Legacy earn()-style public timing hooks are economic-authority surfaces.
  • Require valuation to survive realistic unwind size. If the vault cannot actually exit its strategy inventory near the marked value at protocol size, do not let that mark drive shares or payouts.
  • Separate price for routing this trade from price for valuing the vault. Execution helpers and solvency helpers should not silently reuse the same manipulable quote path.
  • Bind withdrawal payouts to realizable reserve value, not to hypothetical controller-side best-exit math that the vault never forces the strategy to execute.
  • Treat idle buffers as part of the accounting oracle. If a user can mint under a poisoned mark and redeem from clean local liquidity, the buffer is monetizing the oracle gap.
  • Add delayed recognition, per-block movement caps, or circuit breakers to strategy valuation updates when the underlying venues can be flash-skewed or one-sided.
  • Review vault, controller, adapter, venue, and keeper assumptions as one system. A safe-looking vault can still inherit a manipulable accounting oracle from a controller helper or strategy adapter.
  • Rehearse how to pause deposits, earn(), rebalances, and withdrawals independently. These incidents often require stopping only the timing seam first, not the entire protocol.

Audit prompts

  • Which exact function decides minted shares on deposit and redeemed assets on withdrawal, and what live market or strategy state does it trust?
  • Can an attacker both skew the referenced venue and choose the precise block when the vault reads that skewed state through deposit, earn(), rebalance, or AUM update calls?
  • Does the vault mark invested inventory to a hypothetical unwind quote even when withdrawals can be paid from idle buffers without forcing that unwind to occur?
  • If the strategy venue is heavily imbalanced for one block, how far can reported invested balance, share price, or controller AUM move, and what user actions become possible during that window?
  • Are entry and exit accounting symmetric, or can the attacker mint against one venue state and redeem against another while the vault internalizes the spread?
  • Which components can publish accounting truth — vault, controller, strategy adapter, keeper, oracle helper — and what prevents a permissionless maintenance call from becoming a permissionless valuation write?
  • Do slippage checks only protect the swap execution itself, or do they also constrain the accounting side effects on share supply, invested balance, and withdrawal entitlement?
  • Would forcing full realizability at withdrawal time kill the exploit, or is the dangerous mark already embedded earlier in share minting and internal inventory publication?
  • Can a same-path reserve update feed back into the very accounting function that just changed those reserves, creating a publish manipulated state, then honor it immediately loop?
  • If a vault strategy or controller claims to use averaged or resistant pricing, where does same-block spot state still leak back in through helper functions, cache refreshes, or emergency paths?

Lessons that should already be standard

  • A vault’s execution path is an oracle if share accounting trusts it. The protocol does not get to call it just routing once deposits and withdrawals are priced off the same state.

  • A route looks like this right now, that route state counts as canonical inventory truth, and that published truth now deserves full mint / redeem authority are three different promotions.

  • Permissionless maintenance verbs like earn() or updateTotalAum() are economic-authority functions when they decide when manipulable market state becomes accounting truth.

  • Hypothetical unwind value is not reserve value. If the vault pays users without forcing the unwind, it should not pretend the quote was money-good.

  • Idle buffers amplify oracle mistakes because they let attackers realize clean payouts against dirty marks.

  • Share-price exploits are often quieter than borrow-against-fake-collateral exploits, but the accounting mistake is the same: a transient, attacker-authored market state gets promoted into balance-sheet truth.

  • Slippage protection on swaps does not rescue accounting that still publishes manipulated venue state into share supply or withdrawal entitlement.

  • Controller abstractions are dangerous when they hide which venue state really defines NAV. The team needs one explicit answer to what market fact mints shares here?.

  • The right defense is usually structural separation between valuation truth and attacker-timable execution state, not just tighter arbitrage assumptions.

  • High-signal incidents:

    • Harvest Finance Curve Y pool share-price manipulation (2020-10-26) — the entry-side discounted-mint exemplar: Harvest minted fUSDC / fUSDT against manipulated Curve Y-pool-dependent invested value, then paid redemptions after the pool normalized.
    • Yearn V1 yDAI Curve 3pool share-price manipulation (2021-02-04) — the permissionless strategy-forcing exemplar: the attacker could call earn() and choose when yDAI routed fresh DAI into a badly skewed Curve 3pool.
    • OneRing Finance OShare LP-reserve share-price manipulation drain (2022-03-21) — the same-path reserve-publication exemplar: depositSafe() and _doHardWorkAll() changed local LP reserve composition, getUSDBalanceFromUnderlyingBalance() immediately treated that state as canonical OShare pricing truth, and withdraw() paid against the newly published same-block mark.
    • Value DeFi MultiStablesVault 3Crv share-pricing oracle manipulation (2020-11-14) — the exit-side hypothetical-unwind exemplar: balance_to_sell() priced BCrv and CCrv as if they could all unwind through a poisoned USDC side of Curve, so the vault redeemed far more 3Crv than honest value supported.
    • [[../../../incidents/oracle-market-abuse/makina-finance-dusd-usdc-curve-machineshareoracle-permissionless-updatetotalaum-spot-price-manipulation-drain-2026-01-20|Makina Finance DUSD/USDC Curve MachineShareOracle permissionless updateTotalAum() spot-price manipulation drain (2026-01-20)]] — the publication-path variant: Makina priced a Curve MIM/3CRV position from calc_withdraw_one_coin(), let that manipulated unwind quote update Caliber AUM and Machine AUM in the same block, and then let an external Curve pool trade against the poisoned Machine exchange rate.

Internal linkages

Control surface

  • The leverage sits in vault share-pricing formulas, strategy-entry timing, controller inventory valuation, slippage assumptions, and withdrawal buffers that honor manipulated marks without forcing the same market path to settle.
  • These incidents are easy to flatten into generic oracle manipulation, but the sharper systems lesson is that a vault’s own execution path can secretly be its oracle.
  • Once that happens, the dangerous question is no longer just can the attacker print a price? but can the attacker choose when the vault internalizes that printed price into share issuance, share redemption, or controller inventory truth?

Sources

Last reviewed

  • 2026-08-01 UTC

Graph View

Backlinks