# Risk users are required to payout if the price of the pegged asset goes higher than underlying

Y2k Finance depeg trigger uses absolute price ratio, so a pegged asset trading above its underlying incorrectly triggers insurance payouts to risk users.

- Payout: Contest reward
- Severity: high
- Program: Y2k Finance
- Credited: 0x52
- Disclosed: 2023-01-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-y2k-finance-findings/issues/45
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-y2k-finance%3AH-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity vuln:business-logic vuln:oracle-manipulation

**Target:** Depeg insurance smart contract price-ratio logic
**Root cause:** The ratio is computed from the lower of the two prices (price2/price1 or price1/price2), so any divergence in either direction, including the pegged asset trading above the underlying, is treated as a depeg event.
**Steps:**
1. Observe the ratio logic: `if (price1 > price2) nowPrice = (price2*10000)/price1; else nowPrice = (price1*10000)/price2;`
2. Note the ratio is symmetric, so an upward break of the peg yields the same deviation as a downward break
3. Have the pegged asset trade above the underlying (e.g. stablecoin > $1)
4. The depeg condition triggers and risk users are forced to pay out despite no loss to insured users
**How found:** Code review of the price-ratio calculation; noticed the branch always divides the smaller price by the larger, making the deviation direction-agnostic and thus triggering on upward depegs.
**Insight:** When auditing oracle/peg deviation logic, check whether the ratio is direction-aware; symmetric min/max ratio math silently treats upside and downside deviations identically, which is wrong for one-sided insurance products.