# Incorrect Price Consultation Results

TwapOracle.consult() divides instead of multiplies sumUSD by sumNative, returning a wrongly denominated price that corrupts downstream protocol pricing.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: leastwood
- Disclosed: 2022-02-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-vader-findings/issues/235
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-28
- Tags: area:web3 domain:web3 kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** TwapOracle.consult() price oracle contract
**Root cause:** The consult() function computes (sumUSD * token.decimals()) / sumNative instead of multiplying sumUSD by sumNative, producing a SUSHI^2/(USD*USDV) denominated result rather than USDV/USD.
**Steps:**
1. Read TwapOracle.sol L115-L157 consult()
2. Observe it sums pairs where USDV==pairData.token0 into sumNative (USDV/token1) and sumUSD (token1/USD)
3. Note final computation divides by sumNative instead of multiplying
4. Compare to reference UniswapV2Oracle implementations (dpx-oracle) which multiply
5. Result: consult returns incorrect denomination/price
**How found:** Manual code review of the oracle's price aggregation math, comparing the intended USDV/USD denomination against the actual formula and against reference implementations.
**Insight:** When an oracle aggregates multi-hop rates, verify the dimensional analysis of the final formula: chained rates must multiply, not divide, and decimals must align; cross-check against a known-good reference implementation.