# viewPrice doesn’t always report dampened price

Oracle.viewPrice omits today's dampened low until getPrice runs, so collateral, credit, liquidation and withdrawal views return undampened prices, causing wrong amounts or reverts.

- Payout: Audit contest
- Severity: medium
- Program: Inverse Finance
- Found by: Jeiwan
- Disclosed: 2022-12-20
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-10-inverse#m-11
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-inverse%3AM-11
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** Oracle.sol viewPrice read-only price function
**Root cause:** viewPrice reads dailyLows[token][day] without folding in the current normalizedPrice when today's low is unset or higher, so the dampened low is only recorded when getPrice is called.
**Steps:**
1. Call `oracle.getPrice(WETH, collateralFactor)` at 1600e18; dailyLows[day] = 1600e18.
2. `vm.warp(+1 days)`, set feed to 1200e18, call `oracle.getPrice`; dailyLows[++day] = 1200e18.
3. `vm.warp(+1 days)`, set feed to 3000e18.
4. Call `oracle.viewPrice(WETH, collateralFactor)` before getPrice; it returns 3000e18 undampened.
5. Call `oracle.getPrice`; it returns 1200e18 * 10_000 / collateralFactor, confirming viewPrice diverged.
**How found:** Noticed viewPrice only reads stored dailyLows while getPrice writes today's low, then wrote a PoC warping days and comparing viewPrice against getPrice to show the divergence.
**Exploitation:** Read-only consumers (getCollateralValue, getCreditLimit, getLiquidatableDebt, getWithdrawalLimit) use the undampened viewPrice to size withdrawals or liquidations, so a caller computing amounts off-chain before the write call gets wrong values, leading to wrong withdrawal amounts, wrong liquidation debt, or reverts.
**Insight:** When a view function mirrors a state-mutating price/oracle function, diff the two code paths: any write performed in the mutating path (here updating today's low) that the view skips yields stale values for all downstream read-only consumers.