Why can one flash loan still fake a price and drain an eighteen-million-dollar protocol?

Price oracle manipulation is OWASP's SC03 in the 2026 Smart Contract Top 10 and keeps producing eight-figure losses: $18M from Ostium in July 2026, $42M from GMX in July 2025, and $7M from a single actor manipulating UMA governance on Polymarket in March 2025. The root cause is that on-chain prices are derived from markets that can themselves be moved during a single atomic transaction or over a short window by a well-capitalized attacker. TWAP defenses stretch the attack window but do not eliminate it. Decentralized oracle networks add off-chain aggregators and validator sets that introduce their own trust assumptions. A purely on-chain, manipulation-resistant price primitive that requires no trusted third party does not exist.