defirisk.co
rubric v1.7.0

Oracle pool depth (USD)

A oracle & external dependencies factor in the v1.7.0 rubric. Measured per protocol on a c cadence.

Methodology how we score#

What this measures
This factor records the liquidity depth of the DEX pool feeding the oracle — measured in USD at a reference block. This is a continuous, dynamically updated metric drawn from DEX subgraph queries and on-chain reads. It applies to any protocol using a DEX pool as a price source, whether spot or TWAP.

Why it matters
Pool depth is the economic cost of oracle manipulation. The Inverse Finance exploit is the canonical illustration: with approximately $1M in pool liquidity, an attacker moved the INV price 50x using only 500 ETH, enabling $15.6M in undercollateralised borrowing. Mango Markets suffered $115M in losses from a MNGO spot oracle with thin underlying liquidity. Polter Finance's BOO token oracle had insufficient pool depth to resist the manipulation that resulted in $8.7M in losses. The synthesis dataset (Cluster O) shows that flash-loan amplification makes even "medium-liquidity" pools vulnerable when the protocol TVL is large relative to oracle pool depth.

Green / Yellow / Red
Green is scored when the oracle pool depth exceeds a protocol-TVL-relative threshold that makes manipulation economically irrational (typically oracle pool depth > 5x the maximum single-asset borrow/drain possible). Yellow is scored when pool depth provides partial but not full manipulation resistance. Red is scored when oracle pool depth is demonstrably insufficient to resist a flash-loan-amplified price move.

Common gray cases
Gray is applied when pool depth data cannot be retrieved from available subgraphs or when the oracle source uses an aggregated off-chain feed whose underlying pool depth is not publicly queryable.

Notable historical examples
- Mango Markets ($115M, 2022): Thin MNGO oracle pool; 30x price pump with self-funded positions.
- Harvest Finance ($33.8M, 2020): Curve Y-pool spot price manipulated via flash swap on thin liquidity.
- Inverse Finance ($15.6M, 2022): ~$1M INV/WETH pool depth; 500 ETH moved price 50x.
- Polter Finance ($8.7M, 2024): BOO token SpookySwap pool depth insufficient to resist flash-loan drain.

Measurement what to look for#

Measure the liquidity depth of each DEX pool feeding a TWAP oracle, in USD at reference block; updated continuously.

Data & output #

Data source
Uniswap v3 subgraph (pool TVL query) or equivalent DEX subgraph; on-chain pool `slot0` + `liquidity` reads
Output format
Green / Yellow / Red
Evidence artifact
Pool address + TVL USD + block number + subgraph query timestamp
Confidence signal
green = pool depth ≥$10M; yellow = $1M–$9.9M; red = <$1M (manipulable); gray = protocol does not use DEX-TWAP oracle (N/A)

Scored protocols 0 carry this factor#

No protocols have been scored for this factor yet.

Linked hacks 9 historical incidents#

relatedMakina Finance: Permissionless share price oracle update (updateTotalAum) + flash loan Curve pool manipulation → share price inflation → LP drain2026-01-20 · $4M · Permissionless share price oracle update (updateTotalAum) + flash loan Curve pool manipulation → share price inflation → LP drain · Underlying oracle pool depth (USD) [via cross-hack: Factor 16: Single-Source VWAP / Thin-Liquidity Oracle Without Flash Swap Filtering]
relatedPolter Finance: Spot price oracle manipulation (SpookySwap V2/V3) → inflated BOO collateral → draining borrow2024-11-16 · $9M · Spot price oracle manipulation (SpookySwap V2/V3) → inflated BOO collateral → draining borrow · Underlying oracle pool depth (USD) [via cross-hack: Factor 16: Single-Source VWAP / Thin-Liquidity Oracle Without Flash Swap Filtering] || Underlying oracle pool depth [via cross-hack: Factor 25: Single-Source TWAP Oracle From Low-Liquidity Pool Used as Lending Collateral]
relatedDeus DAO / DEI stablecoin: Mis-ordered Parameters in burnFrom — Public Approval Override2023-05-06 · $7M · Mis-ordered Parameters in burnFrom — Public Approval Override · Underlying oracle pool depth (USD) [via cross-hack: Factor 16: Single-Source VWAP / Thin-Liquidity Oracle Without Flash Swap Filtering]
relatedMango Markets: Self-funded MNGO spot price pump using two accounts → inflated unrealized collateral → lending pool drain2022-10-11 · $115M · Self-funded MNGO spot price pump using two accounts → inflated unrealized collateral → lending pool drain · Underlying oracle pool depth [via cross-hack: Factor 25: Single-Source TWAP Oracle From Low-Liquidity Pool Used as Lending Collateral]
relatedElephant Money: Flash loan + spot price manipulation during stablecoin minting2022-04-12 · $22M · Flash loan + spot price manipulation during stablecoin minting · Underlying oracle pool depth (USD) [via cross-hack: Factor 16: Single-Source VWAP / Thin-Liquidity Oracle Without Flash Swap Filtering]
relatedInverse Finance: SushiSwap TWAP Oracle Manipulation — Thin Liquidity Governance Token2022-04-02 · $16M · SushiSwap TWAP Oracle Manipulation — Thin Liquidity Governance Token · Underlying oracle pool depth (USD) [via cross-hack: Factor 16: Single-Source VWAP / Thin-Liquidity Oracle Without Flash Swap Filtering] || Underlying oracle pool depth [via cross-hack: Factor 25: Single-Source TWAP Oracle From Low-Liquidity Pool Used as Lending Collateral]
relatedSpartan Protocol: Flash loan + inflated pool balance → LP burn liquidity share manipulation2021-05-01 · $31M · Flash loan + inflated pool balance → LP burn liquidity share manipulation · Underlying oracle pool depth (USD) [via cross-hack: Factor 16: Single-Source VWAP / Thin-Liquidity Oracle Without Flash Swap Filtering]
relatedCheese Bank: Flash loan + Uniswap LP spot oracle manipulation → inflated collateral value → drain via borrow()2020-11-06 · $3M · Flash loan + Uniswap LP spot oracle manipulation → inflated collateral value → drain via borrow() · Underlying oracle pool depth (USD) [via cross-hack: Factor 16: Single-Source VWAP / Thin-Liquidity Oracle Without Flash Swap Filtering]
relatedHarvest Finance: Flash loan + Curve Y-pool spot price manipulation → inflated fToken share valuation → vault drain2020-10-26 · $34M · Flash loan + Curve Y-pool spot price manipulation → inflated fToken share valuation → vault drain · Underlying oracle pool depth (USD) [via cross-hack: Factor 16: Single-Source VWAP / Thin-Liquidity Oracle Without Flash Swap Filtering]
rubric_version v1.7.0factor RD-F-055category 3carried 0critical no