# UniswapConfig getters return wrong token config if token config does not exist

UniswapConfig getters check for missing token configs against -1 while the index lookup returns 0, so unknown tokens silently resolve to the first token's config, corrupting oracle prices.

- Payout: Audit contest
- Severity: high
- Program: Based Loans
- Disclosed: 2021-05-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-04-basedloans-findings/issues/37
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-basedloans%3AH-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** UniswapConfig oracle price config contract
**Root cause:** getSymbolHashIndex returns 0 (uninitialized map default) for missing configs, but the outer getters test for non-existence with -1, so the check never triggers and index 0 is returned.
**Steps:**
1. Call `getTokenConfigBySymbolHash` (or `getTokenConfigByCToken`/`getTokenConfigByUnderlying`) with a symbol/address that has no configured token config.
2. `getSymbolHashIndex` returns 0 for the uninitialized map entry.
3. Outer function compares against -1, so the non-existence branch is skipped.
4. Function returns the config at index 0, belonging to a different token.
**How found:** Code review comparing the sentinel value returned by the internal index lookup (0) against the sentinel used in the outer existence check (-1).
**Exploitation:** Attacker supplies a token lacking config; the protocol reads index 0's price/collateral factors instead, enabling borrowing at inflated collateral value or deflated price, producing undercollateralized loans that cannot be liquidated.
**Insight:** When a map lookup returns a zero-value default, verify the caller's sentinel matches it; off-by-sentinel mismatches (0 vs -1) silently bypass existence checks and return the first array element.