Can a TWAP Oracle Still Be Manipulated through a Sustained, Long-Term Attack?

Yes, a TWAP can be manipulated through a "slow-drip" or sustained attack. By repeatedly and consistently manipulating the price just enough to nudge the average in a desired direction over the entire TWAP window, an attacker can slowly shift the reported price without triggering a large deviation alert.

This attack is much more capital-intensive and time-consuming than a flash loan.