# MagicLpAggregator always returns lower than correct answer, leading to arbitrage loss

MagicLpAggregator prices LP tokens using the minimum of two oracle answers across all reserves, undervaluing the LP and enabling arbitrage against any protocol using it.

- Payout: Contest reward
- Severity: medium
- Program: Abracadabra Money
- Credited: Trust
- Disclosed: 2024-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-abracadabra-money-findings/issues/223
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** MagicLpAggregator oracle contract (latestAnswer pricing)
**Root cause:** latestAnswer applies the minimum of the two underlying oracle prices to the sum of both reserves, instead of valuing each reserve at its own price, so any price divergence between the paired assets makes the LP price lower than fair value.
**Steps:**
1. Observe latestAnswer returns `minAnswer * (baseReserve + quoteReserve) / pair.totalSupply()`.
2. Set A=$0.99, B=$1, pool holds 1,000,000 A and 1,000,000 B with 1,000,000 LP supply.
3. Aggregator price = 0.99*2,000,000/1,000,000 = $1.98; fair value = (0.99*1,000,000 + 1*1,000,000)/1,000,000 = $1.99.
4. Buy 100,000 LP at $198,000, redeem underlying, sell 100,000 A + 100,000 B for $199,000.
5. Net $1,000 profit per $0.01 divergence, taken from LP holders.
**How found:** Code reading of latestAnswer revealed the min() of the two oracle answers is multiplied by the combined reserves rather than each reserve priced individually, exposing a systematic undervaluation whenever the pair diverges.
**Exploitation:** Attacker buys LP tokens at the aggregator's undervalued price, redeems them for the underlying assets, and sells those assets at true market value, pocketing the delta at LP holders' expense.
**Insight:** When an LP oracle collapses two assets into one price, check whether it applies a single (min/max) price to the summed reserves instead of pricing each reserve separately; even tiny peg deviations become repeatable arbitrage against any consumer of that oracle.