LP token balanceOf used for pricing
A oracle & external dependencies factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor checks whether the protocol derives pricing from the `balanceOf` of LP tokens held in a contract — a pattern that is manipulable by direct token transfer ("donation") without going through the protocol's normal deposit path. Source inspection identifies whether price calculations depend on `balanceOf` rather than internal accounting state.
Why it matters
Using `balanceOf` for pricing creates a donation-manipulable oracle: any attacker who can transfer tokens directly to the contract (bypassing `deposit()`) can artificially inflate the apparent value of LP shares. The Cashio hack ($48M, 2022) is the definitive case: the CASH stablecoin's LP token collateral validation never checked the `.mint` field of the SPL token, allowing an attacker to create fake collateral. bEarnFi ($18M, 2021) suffered a multi-layer vault accounting failure where token denomination consistency was broken by a similar balance-manipulation path. ERC-4626 share-inflation attacks (Silo Finance variant) use an analogous mechanism. Protocols that use `balanceOf` for pricing without canonical reserve tracking are structurally vulnerable.
Green / Yellow / Red
Green is scored when pricing is derived from internal accounting state (tracked reserves, virtual shares) rather than live `balanceOf` calls. Yellow is scored when `balanceOf` is used but mediated through a time-delayed or TWAP-based calculation that reduces instant manipulation risk. Red is scored when the protocol derives collateral or exchange-rate pricing directly from `balanceOf` of an LP or vault token with no additional protection.
Common gray cases
Gray is applied when the pricing mechanism is implemented in an upgradeable module and the current deployed logic cannot be confirmed through source inspection alone.
Notable historical examples
- Cashio ($48M, 2022): LP token collateral validation relied on balance fields; the `.mint` field was never validated, enabling fake collateral creation.
- bEarnFi ($18M, 2021): Multi-layer vault strategy used cross-token balance accounting that was manipulated via token denomination mismatch.
Measurement what to look for#
Determine whether protocol pricing is derived from the `balanceOf` of LP tokens in a contract (manipulable by direct token transfer / donation).