  The evolving landscape of Decentralized Finance (DeFi) has raised critical
security concerns, especially pertaining to Protocols for Loanable Funds (PLFs)
and their dependency on price oracles, which are susceptible to manipulation.
The emergence of flash loans has further amplified these risks, enabling
increasingly complex oracle manipulation attacks that can lead to significant
financial losses. Responding to this threat, we first dissect the attack
mechanism by formalizing the standard operational and adversary models for
PLFs. Based on our analysis, we propose SecPLF, a robust and practical solution
designed to counteract oracle manipulation attacks efficiently. SecPLF operates
by tracking a price state for each crypto-asset, including the recent price and
the timestamp of its last update. By imposing price constraints on the price
oracle usage, SecPLF ensures a PLF only engages a price oracle if the last
recorded price falls within a defined threshold, thereby negating the
profitability of potential attacks. Our evaluation based on historical market
data confirms SecPLF's efficacy in providing high-confidence prevention against
arbitrage attacks that arise due to minor price differences. SecPLF delivers
proactive protection against oracle manipulation attacks, offering ease of
implementation, oracle-agnostic property, and resource and cost efficiency.
