# totalLiquidityWeight Is Updated When Adding New Token Pairs Which Skews Price Data For getVaderPrice and getUSDVPrice

Adding a new VADER pair inflates totalLiquidityWeight before syncVaderPrice runs, skewing TWAP liquidity weights and VADER/USDV price data.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: leastwood
- Disclosed: 2022-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-vader-findings/issues/105
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-11
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** LiquidityBasedTWAP.sol price oracle contract
**Root cause:** _addVaderPair increments totalLiquidityWeight[VADER] immediately, but syncVaderPrice reads that total while only summing pastLiquidityWeights for pairs whose update period elapsed, so the new pair's weight is counted in the total but not in the per-pair weights.
**Steps:**
1. Owner calls `_addVaderPair(pair, oracle, updatePeriod)` which does `totalLiquidityWeight[VADER] += pairLiquidityEvaluation`
2. Before the new pair's updatePeriod elapses, call `syncVaderPrice()`
3. `pastTotalLiquidityWeight` includes the new pair's weight, but the loop `continue`s for the new pair so `pastLiquidityWeights[i]` stays 0
4. Resulting weights are inconsistent, skewing computed VADER and USDV prices
**How found:** Code review of _addVaderPair and syncVaderPrice, noticing the total is incremented at add-time while per-pair weights are only populated after the update period.
**Exploitation:** Owner adds a pair, then anyone calls syncVaderPrice before the update period passes; the inflated totalLiquidityWeight against underrepresented pastLiquidityWeights skews the TWAP price used by getVaderPrice/getUSDVPrice.
**Insight:** When a running total and its per-item components are updated at different times (add-time vs sync-time), check whether a sync between the two events produces a total that doesn't match the sum of components.