# Verses on Variable Manipulation Vulnerabilities in 2023

By [nordic-noir](https://paragraph.com/@nordic-noir) · 2023-11-20

---

This is a tribute to Istanbul and all the trust gathered @trustX Devconnect week in Instanbul.

**Variable Manipulation**

Manipulation of price, rewards, rates,  
It comes with many names.  
Just like Istanbul, also known in history as Konstantinopel or Stamboul,  
With its beating heart residing in this one place.  
For manipulation, it is in this **one** variable.  
This variable can be maneuvered up and down,  
Altering with drastic velocity,  
And seemingly unfathomable unpredictability,  
Gaining profits via a certain kind of repeatability.  
That is perceived as a great deal of maniputability.

  
In 2023, cases of manipulation are prevalent,  
Week after week, mounting more than sixty-eight,  
Until the very present moment.  
One wonders why it is so omnipresent?

  
There is a thin line between manipulation and what is considered normal operation.  
The same equation fulfills  
A kind of manifestation  
Of giving credits for participation,  
From pools of other people’s contribution.

  
Be it rewards accrued, rate deserved, or price reached,  
A slight edge can be magnified in a flash,  
Accessing a different kind of cash.  
Through a clever conjunction of hashes,  
One can set ablaze some logic to ashes.

  
Manipulation is the dark side of the moon,  
The other side of a coin,  
After all, variables need to be able to **vary**, and  
How a variable varies becomes the quintessential character  
Of our enquiry.  
  
  
`balanceOf` is often involved.  
It is not just the `balanceof`s of major tokens on various exchanges.  
It is not just the `balanceOf`s of minor tokens of little known origin.  
It is not just the `balanceOf`s of `aToken`, `cToken`, `dToken` and `eToken` of lending protocols.  
It is not just the `balanceOf`s of shares in a vault.  
It is **ALL** of them.  
It is all of those that can be transformed at will by any one at any time.  
  
  
Manipulation, like the Bosporus bridge, is a crossing point, a meeting place of  
Logics of `balanceOf`s, from one protocol ending on one side to some unknown otherness starting on the other.  
  
  
Like good old fashioned auditors, the  
Eyes are on functions of `balanceOf`, paying attention to  
Their whereabouts,  
Their ranges,  
All the intermediate stages, that can cause  
Any kind of changes.  
  
  
This gets tricky sometimes, when the `balanceOf`  
Comes from somewhere else,  
Or something else.  
  
  
`balanceOf` appears normal.  
`balanceOf` is not novel.  
`balanceOf` is everywhere, where it can hide in  
Plain sight and doesn't play fair.  
  
  
Where do `balanceOf` live?  
Yes, the home is the seemingly simplest, most  
Known primitive in DeFi, the  
Fungible token standard of the most general sense.  
In ERC twenty there lies your bounty.

---

*Originally published on [nordic-noir](https://paragraph.com/@nordic-noir/verses-on-variable-manipulation-vulnerabilities-in-2023)*