# Newly Registered Assets Skew Consultation Results

Newly registered token pairs in Vader's TwapOracle return zero native average, skewing consult() price toward Chainlink sumUSD and yielding false oracle prices.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: leastwood
- Disclosed: 2022-02-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-vader-findings/issues/249
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-30
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:oracle-manipulation

**Target:** TwapOracle.consult() price oracle
**Root cause:** Newly registered pairs have default price1Average of 0, so native amount contributes 0 while Chainlink still returns a valid price, skewing the averaged consultation. The guard `require(sumNative != 0)` checks the wrong variable instead of the decoded price1Average.
**Steps:**
1. Register a new token pair and Chainlink aggregator in TwapOracle.
2. Before the next update interval, price1Average remains 0 for the pair.
3. Call `TwapOracle.consult()`; native amount decodes to 0 but Chainlink sumUSD is added.
4. Observe skewed/incorrect price returned for the asset.
**How found:** Manual code review of consult() iteration over registered pairs and the price1Average default/guard logic; noticed the require checks sumNative rather than the decoded average.
**Insight:** When an oracle averages multiple sources, audit the initialization state of newly added sources: a default-zero slot silently contributes zero while other sources contribute real values, biasing the average. Also verify guards check the decoded value, not an aggregate that can be nonzero from other sources.