# Re-adding assets to the omnipool can cause a problem with the oracle

Removing an asset from HydraDX omnipool leaves stale EMA oracle entries, so re-adding it at a new price yields a wrong oracle price and blocks add_liquidity.

- Payout: Contest reward
- Severity: medium
- Program: HydraDX
- Credited: TheSchnilch
- Disclosed: 2024-04-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-hydradx-findings/issues/73
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-hydradx%3AM-07
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:medium tech:rust technique:regression technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Substrate omnipool pallet and EMA oracle pallet
**Root cause:** remove_token deletes omnipool asset state but not the ema-oracle StorageNMap entries; on re-add, the EMA blends pre-removal entries with new ones, producing a wrong price.
**Steps:**
1. add_token(DOT, price=1.0), sacrifice_position, set_asset_tradable_state(FROZEN), remove_token(DOT)
2. advance several blocks; oracle entries for DOT remain
3. transfer liquidity and add_token(DOT, price=10.0)
4. call add_liquidity(DOT) -> fails with PriceDifferenceTooHigh because ensure_price compares against stale EMA
5. EmaOracle::get_price(LRNA, DOT, Short, OMNIPOOL_SOURCE) returns a value != 10
**How found:** Code review of remove_token vs ema-oracle storage: noticed oracle entries are not cleared on removal, then wrote an integration test re-adding DOT at a changed price to confirm the EMA skew.
**Exploitation:** No direct theft; a protocol consuming the oracle gets a wrong price for the re-added asset during the short EMA window, and LPs are temporarily blocked from adding liquidity.
**Insight:** When auditing pool/pallet removal logic, check every auxiliary store keyed by asset (oracles, EMA, TWAP) is purged on removal; stale time-weighted state resurfaces on re-add and skews derived prices.