# Oracle returns an improperly scaled USDV/VADER price

LBT oracle mis-scales USDV/VADER price, returning 1e8 instead of 1e18 for $1, corrupting IL protection and USDV mint/burn rates.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: TomFrenchBlockchain
- Disclosed: 2022-05-03
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-12-vader-findings/issues/70
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-05
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:oracle-manipulation vuln:precision-loss

**Target:** LiquidityBasedTWAP oracle price calculation
**Root cause:** Chainlink's 8-decimal foreign price is used directly as totalUSD while totalUSDV is computed in 18-decimal fixed point, so the returned price is off by 1e10 and never normalized to the protocol's expected 1e18 scale.
**Steps:**
1. Set up single USDV-DAI pair, USDV=DAI=1:1, Chainlink DAI=$1.
2. Trace LiquidityBasedTWAP.sol L393-409: foreignPrice=getChainlinkPrice(DAI)=1e8.
3. With liquidityWeights=1, totalUSD=foreignPrice=1e8.
4. totalUSDV = nativeTokenPriceAverage(2**112).mul(foreignUnit 1e18).decode144() = 1e18.
5. _calculateUSDVPrice returns (1e8*1e18)/1e18 = 1e8, but USDV.sol expects 1e18 to mean $1.
6. Observe 1e10 scale error propagates to IL protection and USDV mint/burn.
**How found:** Code review of the oracle's scaling: noticed Chainlink returns 8 decimals while the protocol's fixed-point math uses 18, then hand-traced the simplest 1:1 case to confirm the returned value (1e8) contradicts the 1e18 convention used in USDV.sol.
**Exploitation:** Oracle feeds wrong USDV/VADER exchange rate into IL protection and USDV mint/burn logic; an attacker could mint/burn or claim IL at skewed rates to drain protocol funds.
**Insight:** When an oracle mixes an external feed (Chainlink 8 decimals) with internal fixed-point (1e18), hand-trace the trivial 1:1 case and compare the returned magnitude against the consumer contract's expected scale; a silent 1e10 mismatch is easy to miss in review.