# Vader TWAP averages wrong

syncVaderPrice skips uninitialized pair weights and can be double-called to zero totalLiquidityWeight, reverting all Vader price reads and enabling easier price manipulation.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: cmichel
- Disclosed: 2022-05-03
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-12-vader-findings/issues/148
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-04
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos vuln:oracle-manipulation

**Target:** LiquidityBasedTWAP.syncVaderPrice / getVaderPrice oracle
**Root cause:** syncVaderPrice skips pairs whose update window hasn't elapsed, leaving pastLiquidityWeights[i] uninitialized and excluding their weight from _totalLiquidityWeight, which is then overwritten in storage each call.
**Steps:**
1. Call `syncVaderPrice()` once so all eligible pairs update and lastMeasurement = block.timestamp.
2. Call `syncVaderPrice()` again in the same block: every pair is skipped, `_totalLiquidityWeight` stays 0, storage `totalLiquidityWeight[VADER]` set to 0.
3. Any call to `getVaderPrice`/`getStaleVaderPrice` now reverts in `_calculateVaderPrice` due to division by zero.
4. Repeat double-call each time an update window becomes eligible to keep weight at zero.
**How found:** Code reading of syncVaderPrice: noticed the `continue` on unelapsed update period skips both weight assignment and total accumulation, then reasoned about calling it twice in one block to zero the stored total.
**Exploitation:** Attacker repeatedly calls syncVaderPrice twice per block to force totalLiquidityWeight to zero, permanently reverting price reads; this bricks USDV.mint and VaderReserve.reimburseImpermanentLoss router calls, and also lets attacker manipulate price via a single pair since other pairs' weights are ignored.
**Escalation:** Persistent DoS on minting and IL reimbursement; reduced manipulation surface to a single pair.
**Insight:** In TWAP/oracle accumulators, check that skipped iterations still contribute prior weights to totals; test idempotency by invoking the sync/update function twice in the same block to see if stored aggregates get clobbered to zero.