# RTokenAsset price estimation accounts for margin of error twice

RTokenAsset multiplies BU price by basket range, both of which already include oracle error margin, double-counting uncertainty and widening the RToken price estimate.

- Payout: Contest reward
- Severity: medium
- Program: Reserve
- Credited: 0xA5DF
- Disclosed: 2023-11-13
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-reserve-findings/issues/31
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** RTokenAsset.sol tryPrice()/lotPrice() price estimation
**Root cause:** BU price estimation already accounts for oracle error, and basketRange() also applies oracle error when valuing non-basket collateral; multiplying the two compounds the margin of error.
**Steps:**
1. Basket = 1 ETH + 1 cUSDCv2; cUSDCv2 defaults, backup AAVE-USDC kicks in with 0 balance before rebalancing.
2. basketRange() divides ETH low price by buPriceHigh to value excess collateral.
3. tryPrice()/lotPrice() then multiply that result by buPriceLow, applying oracle error a second time.
4. Result: low estimate is lower and high estimate higher than warranted, widening the RToken price range.
**How found:** Code reading of RTokenAsset price formula and basketRange() revealed oracle error applied in both the BU price and the basket range computation, then multiplied together.
**Insight:** When composing price oracles, check whether each factor already embeds an error/slippage margin; multiplying two error-adjusted values compounds uncertainty, especially in parent-child RToken pricing where basketsHeld.bottom can be 0.