LP token balanceOf used for pricing
A oracle & external dependencies factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor checks whether the protocol derives pricing from the `balanceOf` of LP tokens held in a contract — a pattern that is manipulable by direct token transfer ("donation") without going through the protocol's normal deposit path. Source inspection identifies whether price calculations depend on `balanceOf` rather than internal accounting state.
**Why it matters** Using `balanceOf` for pricing creates a donation-manipulable oracle: any attacker who can transfer tokens directly to the contract (bypassing `deposit()`) can artificially inflate the apparent value of LP shares. The Cashio hack ($48M, 2022) is the definitive case: the CASH stablecoin's LP token collateral validation never checked the `.mint` field of the SPL token, allowing an attacker to create fake collateral. bEarnFi ($18M, 2021) suffered a multi-layer vault accounting failure where token denomination consistency was broken by a similar balance-manipulation path. ERC-4626 share-inflation attacks (Silo Finance variant) use an analogous mechanism. Protocols that use `balanceOf` for pricing without canonical reserve tracking are structurally vulnerable.
**Green / Yellow / Red** Green is scored when pricing is derived from internal accounting state (tracked reserves, virtual shares) rather than live `balanceOf` calls. Yellow is scored when `balanceOf` is used but mediated through a time-delayed or TWAP-based calculation that reduces instant manipulation risk. Red is scored when the protocol derives collateral or exchange-rate pricing directly from `balanceOf` of an LP or vault token with no additional protection.
**Common gray cases** Gray is applied when the pricing mechanism is implemented in an upgradeable module and the current deployed logic cannot be confirmed through source inspection alone.
**Notable historical examples** - **Cashio** ($48M, 2022): LP token collateral validation relied on balance fields; the `.mint` field was never validated, enabling fake collateral creation. - **bEarnFi** ($18M, 2021): Multi-layer vault strategy used cross-token balance accounting that was manipulated via token denomination mismatch.
Measurement what to look for #
Determine whether protocol pricing is derived from the `balanceOf` of LP tokens in a contract (manipulable by direct token transfer / donation).