# Oracle doesn't calculate USDV/VADER price correctly

Vader's LiquidityBasedTWAP oracle averaged USDV prices denominated in different foreign assets, producing invalid USDV/VADER exchange rates used for IL protection and mint/burn.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: TomFrenchBlockchain
- Disclosed: 2022-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-vader-findings/issues/42
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** LiquidityBasedTWAP oracle contract
**Root cause:** totalUSDV averages USDV price expressed in different foreign assets (e.g. ETH and BTC) without converting to a common USD unit, so the weighted average mixes incompatible units.
**Steps:**
1. Read LiquidityBasedTWAP.sol L393-L409 computing totalUSD and totalUSDV.
2. Observe totalUSDV = (USDVPriceInForeign0*w0 + USDVPriceInForeign1*w1)/totalWeight where each term is in a different foreign unit.
3. Note the intended design: convert each USDV price to USD first, then weight-average.
4. Conclude returned USDV/VADER rate is invalid whenever oracle uses >1 foreign asset.
**How found:** Code review of the oracle price aggregation; noticed the terms in totalUSDV carry different units, indicating averaging happened before conversion to a common USD denominator.
**Insight:** In multi-asset oracle aggregation, verify every term in a weighted average shares the same unit/denominator before summing; averaging prices quoted in different base assets silently corrupts the result.