POC-005 · Aave V3 Oracle Manipulation
ProtocolAave V3
CouplingL2×L5 oracle→liquidation
WLS score80
Attack typeFlash loan → oracle → mass liquidation
Adelic sorry: corrupted accretion disk (L2) fed into control orbit (L5) faithfully — L5 does not know L2 was manipulated.
Theorem: aave_l2_l5_trust
∀ (rate : PriceRate),
L5.uses(rate) → rate.assumed_fresh = true
Corollary:
L5 has no internal freshness check
L5 trusts L2 unconditionally
Flash loan can corrupt L2 for 1 tx
→ L5 acts on corrupted price as fact
FLASH LOAN ATTACK PATH
Step 1: Attacker borrows large amount (flash loan)
Step 2: Dumps asset → manipulates pool price → corrupts L2
Step 3: L2 (oracle) now reports wrong price to L5
Step 4: L5 liquidation engine reads L2 faithfully
Step 5: Healthy positions appear undercollateralised
Step 6: Mass liquidation executed · attacker profits
Step 7: Flash loan repaid in same tx
Missing invariant:
L5 does not verify L2 freshness
No cross-layer validation
L2→L5 trust gap is structural
ADELIC LAYER ANALYSIS
L2 roleOracle/sensor (ℚ₃)
L5 roleControl/liquidation (ℚ₁₁)
Coupling typeL2 output = L5 input (no validation)
Missing layerL3 validation between L2→L5
Black hole analogy:
L2 = accretion disk (can be corrupted)
L5 = event horizon orbit
No validation between disk and orbit
Corrupted disk → corrupted orbit
"L5 trusts L2. L2 is lying."