# CurveStableMetapoolCollateral.tryPrice returns a huge but valid high price when the price oracle of pairedToken is timeout

CurveStableMetapoolCollateral.tryPrice returns near-FIX_MAX high price when pairedToken Chainlink oracle times out, mispricing collateral in auctions.

- Payout: Contest reward
- Severity: medium
- Program: Reserve
- Credited: ronnyx2017
- Disclosed: 2023-11-13
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-reserve-findings/issues/25
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** CurveStableMetapoolCollateral price oracle plugin
**Root cause:** tryPairedPrice is wrapped in an empty catch; on Chainlink oracle timeout it reverts, leaving highPaired=FIX_MAX, which safeMul propagates to aumHigh=FIX_MAX and divides by supply to yield a huge but valid high price.
**Steps:**
1. Observe tryPrice calls `this.tryPairedPrice()` inside `try/catch {}` with empty catch.
2. Force chainlinkFeed.price(oracleTimeout) to revert (oracle timeout).
3. highPaired stays FIX_MAX; _metapoolBalancesValue does `highPaired.safeMul(pairedBal, CEIL)` returning FIX_MAX, so aumHigh=FIX_MAX.
4. high = aumHigh.div(supply, CEIL) yields ~FIX_MAX/totalSupply, a huge valid price.
5. This mispriced high feeds rewards trade and rebalance auctions.
**How found:** Code reading of tryPrice/tryPairedPrice: noticed empty catch block swallowing oracle revert and traced how FIX_MAX highPaired propagates through safeMul into aumHigh and final high price.
**Insight:** Empty catch blocks around oracle calls silently substitute FIX_MAX as a 'valid' high price; trace how sentinel max values flow through safeMul/div to confirm they survive as plausible prices rather than reverting.