# UniswapV3 tokens of certain pairs will be wrongly valued, leading to liquidations

ParaSpace's UniswapV3 oracle computes sqrtPriceX96 with division before scaling, zeroing out for pairs with >1e18 price ratio, undervaluing collateral and triggering wrongful liquidations.

- Payout: Contest reward
- Severity: high
- Program: ParaSpace
- Credited: Trust
- Disclosed: 2023-04-27
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-paraspace-findings/issues/486
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AH-09
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:liquidation vuln:oracle-manipulation

**Target:** UniswapV3OracleWrapper.getTokenPrice / _getOracleData price feed
**Root cause:** sqrtPriceX96 is computed as sqrt(token0Price*1e18/token1Price)*2**96/1e9, so the integer division truncates to 0 when token1Price > token0Price*1e18; the 2**96 scaling is applied after the division instead of before.
**Steps:**
1. Deposit a UniswapV3 LP NFT for pair A/B as collateral in ParaSpace.
2. Have token B price rise so token1Price > token0Price * 10**18 (e.g. WETH vs BTT).
3. Call getTokenPrice(tokenId): _getOracleData returns sqrtPriceX96 = 0.
4. LiquidityAmounts.getAmountsForLiquidity with sqrtRatioX96=0 hits the `sqrtRatioX96 <= sqrtRatioAX96` branch, counting all liquidity as amount0 only.
5. Health factor computed via calculateUserAccountData/_getUserBalanceForUniswapV3 is understated; liquidator liquidates the position.
**How found:** Code review of the sqrtPriceX96 math in _getOracleData, noticing the 2**96 scaling happens after an integer division that can truncate to zero for tokens with large price disparities.
**Exploitation:** Attacker/liquidator waits until a UniswapV3 pair's price ratio exceeds 1e18 (or pushes it), causing the oracle to value the victim's LP collateral as only the cheaper token; the understated health factor lets the liquidator liquidate a healthy position and seize the NFT collateral.
**Insight:** In oracle math, check the order of scaling vs integer division: any `(a*1e18)/b` before a fixed-point shift can truncate to zero for extreme price ratios; test with real token pairs spanning many orders of magnitude (e.g. WETH vs micro-cap tokens).