Enso Finance DPI Strategy Vault Attack: Oracle Manipulation Caused 5.6 ETH Loss

Oracle security remains one of the most critical components in modern DeFi protocols.

A recent attack against the Enso Finance DPI Strategy Vault resulted in approximately 5.6 ETH in losses. The incident was caused by an oracle price calculation vulnerability that allowed an attacker to manipulate asset valuation and receive an excessive amount of vault shares.

At PandaSecurity, we analyzed this incident to understand the root cause, attack flow, and security lessons that DeFi developers should consider when designing vaults and oracle systems.

Attack Overview

Protocol: Enso Finance DPI Strategy Vault
Loss: ~5.6 ETH
Attack Type: Oracle Manipulation
Affected Component: Strategy Vault Valuation Oracle

The vulnerability existed in the vault’s asset valuation mechanism.

During the deposit process, the vault calculates the number of shares to mint based on the strategy value before and after the user’s deposit:

shares =
(amountAdded * totalSupply) / valueBefore

If the oracle reports an incorrect strategy value, the share calculation becomes inaccurate.

The attacker exploited this by causing the vault to overestimate asset value, resulting in excessive shares being minted.

These inflated shares were later redeemed for underlying assets, extracting value from existing vault users.

Root Cause Analysis

The vulnerable price calculation chain:

Controller.deposit()

        ↓

EnsoOracle.estimateStrategy()

        ↓

ItemEstimator

        ↓

ProtocolOracle.consult()

        ↓

Uniswap V3 pool.observe()

The protocol relied on Uniswap V3 oracle data to calculate token prices.

The issue was not caused by Uniswap V3 itself. The problem was the oracle configuration and the lack of validation around TWAP parameters.

Incorrect Uniswap V3 TWAP Configuration

Uniswap V3 TWAP pricing uses:

pool.observe(secondsAgos)

The secondsAgo parameter determines the historical time window used for calculating the average price.

A secure implementation should validate this parameter:

require(secondsAgo >= MIN_TWAP_PERIOD);

However, the vulnerable design trusted registry-provided configuration values without ensuring that the TWAP window was safe.

The vulnerable flow:

Registry.getPoolData()

        ↓

secondsAgo

        ↓

UniswapV3Pool.observe()

        ↓

Incorrect TWAP calculation

        ↓

Wrong token valuation

Missing Oracle Security Checks

1. Missing TWAP Window Validation

A TWAP oracle should enforce a minimum observation period.

Without validation, an unsafe value could result in a price calculation close to the current spot price.

Example:

secondsAgo = 1;

This effectively reduces the protection provided by TWAP.

Recommended protection:

require(
    secondsAgo >= minimumWindow
);

---

2. Missing Price Deviation Checks

A robust oracle should compare the calculated price against other references.

For example:

require(
    abs(spotPrice - twapPrice)
        < allowedDeviation
);

This prevents abnormal price movements from directly affecting protocol accounting.

---

3. Lack of Liquidity Validation

Uniswap V3 liquidity is concentrated within selected price ranges.

A low-liquidity or imbalanced pool can experience large price movements from relatively small swaps.

Protocols should evaluate:

• liquidity depth
• trading volume
• historical volatility
• pool stability

before using a pool as a critical price source.

Attack Flow

The attack can be summarized as:

1. Manipulate token price environment

        ↓

2. Oracle reads incorrect Uniswap V3 valuation

        ↓

3. Vault calculates inflated strategy value

        ↓

4. Attacker deposits assets

        ↓

5. Excessive shares are minted

        ↓

6. Attacker redeems shares

        ↓

7. Profit extracted from vault

The exploit was enabled by the combination of:

• incorrect oracle configuration
• insufficient TWAP validation
• missing price sanity checks
• vulnerable liquidity conditions

Security Lessons for DeFi Developers

Never Trust Oracle Configuration Without Validation

Oracle parameters such as:

• TWAP duration
• price sources
• pool addresses

should always be validated.

---

Use Safe TWAP Windows

Protocols should define minimum and maximum TWAP periods.

Example:

MIN_TWAP_PERIOD = 300;
MAX_TWAP_PERIOD = 86400;

---

Monitor Price Sources

Before relying on a Uniswap V3 pool, developers should verify:

• liquidity distribution
• trading activity
• historical price stability

---

Perform Economic Security Audits

Traditional smart contract audits often focus on:

• reentrancy
• access control
• arithmetic errors

However, DeFi protocols also require:

• oracle manipulation testing
• economic attack simulation
• flash loan analysis
• invariant testing

How PandaSecurity Helps Secure Web3 Protocols

At PandaSecurity, we focus on identifying real-world attack paths in Web3 systems.

Our security research covers:

• Smart Contract Audits
• DeFi Protocol Security Reviews
• Oracle Security Analysis
• EVM Vulnerability Research
• Economic Attack Simulation

Modern DeFi exploits are often caused by interactions between multiple components rather than a single coding mistake.

A protocol may appear secure at the contract level while still containing dangerous economic assumptions.

PandaSecurity helps Web3 teams identify these risks before attackers do.

Conclusion

The Enso Finance DPI Strategy Vault incident demonstrates that oracle security is a fundamental requirement for DeFi protocols.

Using Uniswap V3 as a price source is not enough. Protocols must also ensure:

• correct TWAP configuration
• strict oracle validation
• liquidity awareness
• economic attack resistance

As DeFi systems continue to evolve, security reviews must go beyond code correctness and analyze the complete attack surface.

PandaSecurity provides deep smart contract auditing and security research to help build safer Web3 infrastructure.