# \_curveSwap: getDpxEthPrice and getEthPrice is in wrong order

Dopex _curveSwap used the wrong oracle price per swap direction, so default 0.5% slippage protection computed a bogus minOut, allowing ~11% slippage on upperDepeg.

- Payout: Contest reward
- Severity: medium
- Program: Dopex
- Credited: QiuhaoLi
- Disclosed: 2023-12-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-08-dopex-findings/issues/1558
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** _curveSwap in rdpxV2Core (Curve dpxETH/ETH pool swap)
**Root cause:** The ternary in _curveSwap selects getDpxEthPrice() when swapping ETH->dpxETH and getEthPrice() when swapping dpxETH->ETH, i.e. the inverse of the correct price for each direction, so minOut is computed from the wrong price.
**Steps:**
1. Call upperDepeg(10e18, 0) so minAmount=0 and default 0.5% slippage is used.
2. In _curveSwap with _ethToDpxEth=false, minOut is computed using getEthPrice() instead of getDpxEthPrice().
3. With dpxETH/ETH = 1.8, wrong minOut = 5.53e18 vs correct 17.91e18.
4. Curve exchange executes and returns 15.89e18 ETH, an actual slippage of ~11% far exceeding the intended 0.5%.
**How found:** Code reading of the _curveSwap ternary: noticed the price getter used for each direction was the inverse of the pair being swapped, then wrote a Foundry PoC logging wrong vs correct minOut and realized slippage.
**Exploitation:** An attacker observing a pending upperDepeg/lowerDepeg with default slippage can move the Curve pool price beforehand so the victim swap executes at up to ~11% worse than fair value, capturing the difference; the misordered oracle makes the on-chain minOut check ineffective.
**Insight:** When a swap helper picks an oracle price via a boolean ternary, verify the price's quote direction matches the swap direction; a wrong-direction price still yields a plausible-looking minOut, so only a numeric PoC comparing wrong vs correct minOut exposes the broken slippage guard.