OWASP Warns of Rising Oracle Manipulation Threats in DeFi

Oracle manipulation attacks have become one of the most feared threats in DeFi security, according to OWASP's recent Smart Contract Top 10. In July 2026, the real-world-asset lending protocol Ostium lost between $18 million and $23.75 million on Arbitrum after an attacker compromised an oracle-signer key and a keeper role.

The attacker then pushed future-dated price reports that the contract accepted without question. Three months earlier, Rhea Finance bled $7.6 million when an attacker built fake token pools, traded against them, and let the resulting on-chain prices poison a lending market that trusted them.

Oracle manipulation attack testing is crucial to prevent such incidents. The mechanics of oracle manipulation split into three broad families: spot-price manipulation, TWAP (Time-Weighted Average Price) manipulation, and off-chain oracle compromise.