# Wrong price source in rate math

Does the value used for charging match the value the external system actually transfers or stores?

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2024-10-18. Updated 2026-10-25._

## How it works
Accounting assumes the price or rate it reads is the same one that governs the actual transfer or stored state. When the read source differs from the charged/settled value — a maker price vs a taker price, a tick-derived price vs the stored sqrt price, a view that silently returns zero, or a swapped constant — the contract's bookkeeping diverges from reality. The invariant "value used to charge == value actually moved" breaks, and the gap becomes profit for whoever can trigger it.

## Where it shows up
- Adapters wrapping external marketplaces: which price field is validated vs which the marketplace transfers [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AH-10.md)
- TODO/FIXME comments near price or percentage handling in adapters [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AH-10.md)
- `staticcall` on gauge functions that look like views but call `checkpoint` internally [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-09.md)
- Uniswap V3 ports deriving sqrtPriceX96 from `getSqrtRatioAtTick(currentTick)` instead of stored slot0 price [E3](https://bugbountylibrary.com/r/c4%3A2024-08-superposition%3AM-03.md)
- Implementations of published formulas (GDA, bonding curves) with rate/decay constants in the wrong slots [E4]

## How to review
For every price/rate input, trace it to the exact field the downstream system transfers or stores, and confirm they are the same field. For external calls, check whether a "view" mutates state (making staticcall revert to a default). For Uniswap V3 math, require sqrtPriceX96 to come from stored slot0, never from the floored tick. For formula ports, diff each variable against the reference derivation. The property: the value used in accounting equals the value settled on-chain.

## Variants seen
- Maker price validated, taker price charged by marketplace [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AH-10.md)
- staticcall on state-mutating gauge returns 0, underpricing shares [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-09.md)
- Floored tick used to derive price instead of stored sqrtPriceX96 [E3](https://bugbountylibrary.com/r/c4%3A2024-08-superposition%3AM-03.md)
- Emission rate substituted for decay constant in three functions [E4]

## Impact and severity
Led to pool drainage [E1](https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AH-10.md), reward theft via mispriced shares [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-09.md), reverts and miscomputed liquidity deltas [E3](https://bugbountylibrary.com/r/c4%3A2024-08-superposition%3AM-03.md), and mispriced liquidation auctions over-incentivizing liquidators [E4]. Severity rises when the mismatch is attacker-triggerable and the gap is directly withdrawable; silent zero-returns and swapped constants are worse because they don't revert.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AH-10.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-09.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-08-superposition%3AM-03.md