# RTokenAsset price oracle can return a huge but valid high price when any underlying collateral's price oracle timeout

RTokenAsset oracle returns near-FIX_MAX high price when an underlying collateral oracle times out, distorting RToken price for dependent collateral like Curve metapools.

- Payout: Contest reward
- Severity: medium
- Program: Reserve
- Credited: ronnyx2017
- Disclosed: 2023-11-13
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-reserve-findings/issues/20
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-09
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** RTokenAsset price oracle / BasketHandler
**Root cause:** BasketHandler._price treats a collateral oracle revert as (0, FIX_MAX); safeMul returns FIX_MAX for high, and RToken.tryPrice scales it by range.top/supply, yielding a valid but huge high price instead of an invalid one.
**Steps:**
1. Underlying collateral oracle reverts (timeout) -> IAsset.price() returns (0, FIX_MAX)
2. BasketHandler._price: high256 += qty.safeMul(FIX_MAX) returns FIX_MAX; low reduced by qty share
3. RToken.tryPrice: high = range.top.mulDiv(FIX_MAX, supply, CEIL); no overflow if range.top <= supply
4. Ensure range.top < supply (haircut/undercollateralized) so high < FIX_MAX passes _updateCachedPrice check
5. cachedOracleData set to ~FIX_MAX/2, propagating to paired collateral like CurveStableRTokenMetapoolCollateral
**How found:** Code review of RTokenAsset._updateCachedPrice validity check (low!=0 && high!=FIX_MAX) versus BasketHandler._price behavior on oracle revert; traced safeMul FIX_MAX short-circuit and mulDiv overflow bound to show a valid-but-huge price slips through.
**Exploitation:** No direct theft described; a timed-out collateral oracle causes RTokenAsset to cache a near-FIX_MAX price, which flows into paired-asset pricing (e.g. Curve metapool collateral) and can distort valuations used by downstream protocols.
**Escalation:** Propagation to CurveStableRTokenMetapoolCollateral via tryPairedPrice, affecting any protocol consuming the RToken oracle.
**Insight:** When a validity check rejects the sentinel (0, FIX_MAX), verify every upstream path that can produce a value just below the sentinel—partial basket pricing with one FIX_MAX component scaled by a ratio <1 passes the check while being economically absurd.