Submitted by 00xSEV, also found by OMEN, J4X, miaowu, Myrault, Banditx0x, linmiaomiao, CongZhang-CertiK, n1punp, and jesjupyter
When the price moves, Chainlink instantly reports the spot price, while the TWAP slowly changes the price. The spot price of CoreSaltyFeed can be manipulated, allowing an attacker to move the price in a desired direction.
Note: WBTC and WETH movements of 3% are common and will happen often. For example, about a month ago, there was a 6.5% drop in 20 minutes as reported by Business Insider.
 Variations
Put the code in src/pools/tests/H2.t.sol, run COVERAGE="yes" forge test -f wss://ethereum-sepolia.publicnode.com -vvv --mc H2
(Optional) You can place this AWK script in 1e18.sh, make it executable with chmod +x 1e18.sh, and run COVERAGE="yes" forge test -f wss://ethereum-sepolia.publicnode.com -vvv --mc M2 | ./1e18.sh for a more readable output. This script will convert numbers in exponential notation to a floating point format with three decimal places. For example, 1e17 will be printed as 0.100.
Consider replacing CoreSaltyFeed with a different oracle that provides better protection against manipulation, like Band Protocol.
othernet-global (Salty.IO) confirmed and commented:
Status: Mitigation confirmed. Full details in reports from t0x1c, 0xpiken, and zzebra83.
