# Can not update target price

Broken sanity checks in rampTargetPrice make it impossible for admin to update the target price by even 1 wei, disabling a core customswap feature.

- Payout: Audit contest
- Severity: high
- Program: Boot Finance
- Found by: jonah1005
- Disclosed: 2022-01-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-bootfinance-findings/issues/143
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-bootfinance%3AH-02
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** customswap SwapUtils.rampTargetPrice (Solidity contract)
**Root cause:** The lower-bound check multiplies futureTargetPrice by MAX_RELATIVE_PRICE_CHANGE (a fraction <1) and requires it >= initialTargetPrice, which is mathematically impossible when future < initial; the upper-bound branch has the mirrored inversion.
**Steps:**
1. Read `rampTargetPrice` sanity checks in SwapUtils.sol#L1571-L1581
2. Note `futureTargetPricePrecise.mul(MAX_RELATIVE_PRICE_CHANGE).div(WEI_UNIT) >= initialTargetPricePrecise` when future < initial
3. Call `swap.functions.rampTargetPrice(p1 - 1, future).transact()` -> reverts 'futureTargetPrice_ is too small'
4. Call `swap.functions.rampTargetPrice(p1 + 1, future).transact()` -> reverts 'futureTargetPrice_ is too large'
**How found:** Code review of the rampTargetPrice bounds logic; noticed the multiplication by MAX_RELATIVE_PRICE_CHANGE shrinks the future value instead of bounding the ratio, then confirmed with a web3.py PoC trying ±1 wei.
**Insight:** When auditing ratio/bound checks, verify the direction of multiplication: multiplying by a fraction <1 to enforce a lower bound is inverted logic; test boundary deltas of ±1 wei to expose impossible conditions.