An Oracle Does Not Need to Be Broken to Liquidate You: How Thin Liquidity, a Short TWAP, and Leverage Triggered Morpho Liquidations

⏱️ 6-minute read

An oracle can return the price its design tells it to calculate and still trigger unexpected liquidations. DeFi teams must model that risk when a thin market feeds a short TWAP, especially when collateral is reused in leveraged positions.

An external report described about $36.4 million in liquidations tied to alleged manipulation of a 15-minute TWAP in a Morpho PT-reUSD market. This remains a developing event. Intent, the full mechanism, final losses, and any bad debt need confirmation from primary sources, on-chain evidence, and a postmortem. It is inaccurate to describe the reported amount as funds conclusively extracted by an attacker.

Reported liquidations are not confirmed attacker extraction

A liquidation closes a position whose health factor no longer meets the threshold. The borrower may lose collateral, the liquidator may receive an incentive, and the protocol may recover debt. Liquidation volume, borrower loss, liquidator profit, bad debt, and confirmed attacker extraction are different figures.

That distinction matters in an incident investigation. A headline may measure collateral liquidated, not realized profit for the actor who moved a market. Before attributing losses, separate actor transactions, liquidator gains, bad debt, and price effects that affected other positions.

How a TWAP turns a trade into a liquidation

A TWAP calculates an average price over a window. It reduces noise from a single trade, but a 15-minute window is still a market price. If an actor can sustain buying or selling pressure during that window in a thin market, the average can move materially.

In principal and yield token markets, PT represents principal at maturity and YT represents variable yield. Their prices move inversely. Moving implied yield can reduce the observed PT value. If PT is collateral, a health factor can fall even when the borrower did not change the position.

Risk increases with looped leverage. A user deposits PT, borrows, buys more PT, and deposits it again. This amplifies yield and oracle-valuation sensitivity. Near a liquidation threshold, a short price movement can be enough to close the position.

What an auditor should review

1. Measure the depth, volume, and cost to move the market that feeds an oracle.
2. Test a TWAP under sustained trading, not only one extreme trade.
3. Compare multiple price sources and reject abnormal deviations.
4. Set windows and LTV limits according to liquidity, concentration, and volatility.
5. Add circuit breakers, liquidation limits, and pauses for out-of-range moves.
6. Simulate looped positions and health factors near the threshold.

An oracle does not need to return false data to produce a bad risk decision. If an observable price can move with reasonable capital and a protocol directly turns it into liquidations, the model needs additional limits.

Sources

1. The Crypto Times, “Morpho’s 15-minute TWAP oracle exploited in $36.4M liquidation attack”.