# previousPrices Is Never Updated Upon Syncing Token Price

LiquidityBasedTWAP never updates previousPrices after syncing VADER/USDV price, so currentLiquidityEvaluation uses stale initial price, skewing TWAP liquidity weightings.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: leastwood
- Disclosed: 2022-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-vader-findings/issues/103
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-10
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** LiquidityBasedTWAP.sol oracle/TWAP contract
**Root cause:** syncVaderPrice/_updateVaderPrice computes cumulative averages but never writes the new price back to previousPrices[Paths.VADER] (or USDV), so currentLiquidityEvaluation always multiplies reserves by the setup-time price.
**Steps:**
1. Read LiquidityBasedTWAP.sol#L150-L189: _updateVaderPrice computes nativeTokenPriceAverage and currentLiquidityEvaluation using previousPrices[uint256(Paths.VADER)]
2. Observe previousPrices is only assigned in setupVader (L221-L235), never in sync path
3. Note currentLiquidityEvaluation = reserveNative * previousPrices[VADER] + reserveForeign * chainlinkPrice
4. As Chainlink price diverges from initial vaderPrice, evaluation favors on-chain or off-chain data depending on which is greater
**How found:** Code review of the sync/update path versus the setup path; noticed previousPrices written only in setupVader and read in _updateVaderPrice without being refreshed.
**Insight:** When auditing oracle/TWAP contracts, trace every state variable read in the price-evaluation formula back to its write sites; a value set only at initialization is a classic stale-state bug that silently biases the oracle.