#  _getUniswapTwapWei() will show incorrect price for negative ticks cause it doesn't round up for negative ticks

Salty.IO's Uniswap TWAP helper truncates negative tick averages toward zero instead of rounding down, skewing prices and enabling arbitrage or DoS of liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Salty.IO
- Credited: Bauchibred
- Disclosed: 2024-04-19
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-salty-findings/issues/380
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-18
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:oracle-manipulation vuln:precision-loss

**Target:** CoreUniswapFeed._getUniswapTwapWei price oracle
**Root cause:** int24 cast of (tickCumulatives[1]-tickCumulatives[0])/twapInterval truncates toward zero for negative values, whereas Uniswap's OracleLibrary rounds down, so the returned tick is too high when the remainder is nonzero.
**Steps:**
1. Call `_getUniswapTwapWei(pool, twapInterval)` on a pool whose tickCumulative delta is negative and not divisible by twapInterval.
2. Observe `int24((tickCumulatives[1]-tickCumulatives[0])/int56(uint56(twapInterval)))` truncates toward zero, yielding a tick larger than the true average.
3. Compare against Uniswap OracleLibrary.consult which decrements the tick when the delta is negative and remainder != 0.
4. Resulting sqrtPriceX96 and derived price are inflated, diverging from the correct TWAP.
**How found:** Code review of the TWAP helper against Uniswap's OracleLibrary, spotting the missing round-down for negative tick deltas.
**Exploitation:** Attacker positions a pool's tickCumulative delta negative with a nonzero remainder so the computed tick is overstated; the skewed price feeds PriceAggregator, enabling arbitrage against protocol pricing or causing price-difference checks to revert, blocking functions like CollateralAndLiquidity.liquidate() that call underlyingTokenValueInUSD().
**Escalation:** Skewed TWAP propagates into PriceAggregator weighting, potentially reverting liquidations (DoS) or enabling arbitrage.
**Insight:** When reimplementing Uniswap V3 TWAP math, check the sign handling of the tickCumulative division: Solidity int division truncates toward zero, so negative averages need an explicit decrement to match OracleLibrary and avoid overstating price.