# Unable to retrieve price information with CamelotRelayer contract

CamelotRelayer calls Uniswap V3 OracleLibrary functions (slot0/observations/observe) that Camelot pools don't implement, so all price reads revert.

- Payout: Contest reward
- Severity: medium
- Program: Open Dollar
- Credited: klau5
- Disclosed: 2023-12-20
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-10-opendollar-findings/issues/156
- Library page: https://bugbountylibrary.com/r/c4%3A2023-10-opendollar%3AM-14
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos vuln:oracle-manipulation

**Target:** CamelotRelayer oracle contract / Camelot V3 pool
**Root cause:** CamelotRelayer reuses Uniswap V3 OracleLibrary, which calls slot0(), observations() and observe() on the pool; Camelot pools expose globalState(), timepoints() and getTimepoints() instead, so every call reverts.
**Steps:**
1. Read CamelotRelayer.getResultWithValidity/read: they call `OracleLibrary.getOldestObservationSecondsAgo(camelotPair)` and `OracleLibrary.consult(camelotPair, quotePeriod)`.
2. Note OracleLibrary internally calls `IUniswapV3Pool(pool).slot0()`, `.observations(...)` and `.observe(secondsAgos)`.
3. Resolve CAMELOT_V3_FACTORY `0x1a3c9B1d2F0529D97f2afC5136Cc23e58f1FD35B`, call `poolDeployer()` -> `0x6Dd3FB9653B10e806650F107C3B5A0a6fF974F65`.
4. Inspect pool bytecode: only `globalState`, `timepoints`, `getTimepoints` exist; no `slot0`/`observations`/`observe`.
5. Call `read()` or `getResultWithValidity()` on the relayer -> revert, price never returned.
**How found:** Warden traced the relayer's dependency on Uniswap V3 OracleLibrary, then verified the actual Camelot pool ABI by resolving the factory's poolDeployer and reading the deployed pool code on Arbiscan, spotting the renamed storage/observe functions.
**Insight:** When a protocol reuses a Uniswap V3 periphery library against a 'V3-compatible' fork, diff the fork's pool ABI (slot0/observations/observe) against the library's hardcoded interface calls — forks frequently rename these, silently bricking the oracle.