# OverlayV1UniswapV3Market computes wrong market liquidity

OverlayV1UniswapV3Market used ovlFeed's ethIs0 flag to convert marketFeed liquidity, inverting market depth when token orderings differ.

- Payout: Audit contest
- Severity: high
- Program: Overlay Protocol
- Found by: cmichel
- Disclosed: 2022-01-13
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-overlay-findings/issues/83
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-overlay%3AH-01
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** OverlayV1UniswapV3Market.fetchPricePoint / Uniswap V3 pool liquidity math
**Root cause:** ethIs0 is derived from ovlFeed.token0() but applied to _liquidity observed from marketFeed; if the two pools order ETH differently, the sqrtPrice conversion is inverted.
**Steps:**
1. Read constructor: `ethIs0 = IUniswapV3Pool(_ovlFeed).token0() == _eth`
2. Read fetchPricePoint: `(_ticks,_liqs) = IUniswapV3Pool(marketFeed).observe(_secondsAgo)` then `_marketLiquidity = ethIs0 ? (uint256(_liquidity)<<96)/_sqrtPrice : FullMath.mulDiv(uint256(_liquidity),_sqrtPrice,X96)`
3. Note _liquidity is from marketFeed but branch chosen by ovlFeed ordering
4. Configure ovlFeed and marketFeed with opposite ETH token0/token1 positions
5. Observe depth() returns inverted/wrong market liquidity
**How found:** Code reading: noticed the ethIs0 boolean was set from ovlFeed in the constructor but reused to convert liquidity sourced from a different marketFeed pool.
**Escalation:** Wrong depth feeds OverlayV1Market.depth() and market cap computation, distorting protocol accounting.
**Insight:** When a boolean encodes token ordering for one pool, verify it isn't reused to normalize values pulled from a different pool; cross-check the source of each variable against the flag's origin.