# LP token priced off wrong supply

LP or vault share priced with totalSupply or a single USD oracle, ignoring actual supply or quote-token de-peg

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2024-03-30. Updated 2026-10-24._

## How it works
Share or LP-token value is computed as (pool value) / (supply), or as a single USD price. The assumption that breaks: that the supply figure is the circulating supply, and that one USD oracle prices every asset in the pool. Balancer-style pools can pre-mint BPT, so `totalSupply()` returns a max/initial figure far above circulating supply, exposed correctly via `getActualSupply()` [E2](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-6.md)[E3](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.3.md). Vaults that accept a stablecoin or wrapped asset but price shares with a base/USD oracle omit the quote-token/USD leg, so a de-peg is invisible in share value [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-7.md). Either way the denominator or the price is wrong, and whoever moves first redeems at the wrong rate.

## Where it shows up
- Share math dividing by `totalSupply()` on Balancer BPT or similar pre-minted LP tokens [E2](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-6.md)[E3](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.3.md)
- Oracle code computing BPT price as TVL / `totalSupply()` [E3](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.3.md)
- Vault withdraw/share pricing using one USD oracle per asset while accepting a stablecoin or wrapped collateral [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-7.md)
- Integrations that assume one supply getter works for all pool types or versions [E3](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.3.md)
- Comments or READMEs claiming a single oracle prices all collateral [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-7.md)

## How to review
For each LP or share price, identify the exact supply getter and confirm it returns circulating supply for that specific pool instance (check `getActualSupply()` vs `totalSupply()` per pool, not per protocol) [E2](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-6.md)[E3](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.3.md). For each collateral asset, confirm the price path includes every leg: base/USD alone is insufficient when the quote is USDT or a wrapper; the quote-token/USD conversion must be present [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-7.md). Invariant: share price = total pool value in one consistent unit / circulating supply, with no asset valued by a proxy that ignores its actual market price.

## Variants seen
- Vault share value using base/USD oracle, missing quote-stablecoin de-peg [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-7.md)
- SPPLY module using `totalSupply()` instead of `getActualSupply()` for Balancer LP [E2](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-6.md)
- BPTOracle using `totalSupply()` for newer weighted pools, understating BPT price and TVL [E3](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.3.md)

## Impact and severity
Mispriced shares let early withdrawers over-redeem at other LPs' expense during a de-peg [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-7.md), and grossly misprice POL, driving incorrect RBS deployment [E2](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-6.md) and wrong BPT price/TVL in Omnipool [E3](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.3.md). Severity rises with how far the supply or price is off and whether withdrawals or protocol-owned liquidity depend on the figure. All three were medium-severity findings with no payout recorded.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-7.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-6.md
- E3: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.3.md