Oracle Manipulation Risk Report: Bybit

Bybit, a multi-chain DeFi hub offering spot trading, perpetual contracts, lending, and synthetic products, relies on external price feeds (oracles) for settlements, liquidations, and interest rate calculations. With a TVL of approximately $16.06 billion, oracle integrity is crucial for the platform's security.

The report identifies four primary oracle-related attack vectors:

1. Single-Source Dominance: A coordinated market-making attack could shift reported prices by up to 5% for low-liquidity alt-coins within a single block.

2. Time-Weighted Median (TWM) Manipulation via Flash Loans: An attacker could use flash loans to artificially inflate or deflate prices on a target exchange, affecting short-duration contracts and oracle-dependent interest rates.

3. Cross-Chain Feed Desynchronisation: If the bridge between Bybit's L2 and the Ethereum mainnet experiences congestion or a replay attack, L2 may continue using stale prices from the mainnet while it moves sharply.

4. Oracle Update Gas-Price Manipulation (L2): By out-bidding the legitimate update, an attacker could manipulate the oracle with a manipulated price before the honest price arrives.

Five other attack vectors include data-provider compromise, economic incentive mis-alignment in aggregator governance, and oracle update gas-price manipulation (L2). The report recommends several high-priority technical measures, including diversifying primary sources, increasing aggregation window and sample size, introducing on-chain price deviation guards, and implementing gas-price protection mechanisms.