# Calculated token0TVL may be zero under certain scenarios

Integer division ordering in getPriceLP truncates token0TVL to zero for high-decimal stablecoins, halving LP token price used by the oracle.

- Payout: Contest reward
- Severity: medium
- Program: Canto
- Credited: hickuphh3
- Disclosed: 2023-03-31
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-canto-findings/issues/41
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-canto%3AM-02
- Tags: domain:web3 kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:oracle-manipulation vuln:precision-loss

**Target:** BaseV1Router getPriceLP LP price oracle
**Root cause:** `assetReserves[i] * (prices[i] / decimals)` performs integer division before multiplication, so when prices[i] < decimals the quotient truncates to zero, zeroing token0TVL.
**Steps:**
1. Deploy a 24-decimal stablecoin with address > note so token0 == note in a stable pair.
2. Add liquidity note/stablecoin, set periodSize to 0, perform 10 alternating swaps to populate price observations.
3. Call `getPriceLP(pairAddr)`; observe returned price 999500000001499 instead of expected 1999999998838589.
4. Apply fix `assetReserves[i] * prices[i] / decimals` and re-run to see doubled correct price.
**How found:** Code reading of the TVL formula spotted the parenthesized division executed before multiplication, then constructed a high-decimal stablecoin test to trigger truncation to zero.
**Exploitation:** LP price oracle under-reports value for pairs with high-decimal tokens; downstream consumers relying on getPriceLP get a wrong (halved) LP valuation, potentially mispricing collateral.
**Insight:** When auditing price/TVL math, check operator precedence and integer division ordering; tokens with decimals > 18 (or price scaling below 1e18) are the trigger for truncation-to-zero bugs.