#  _getReferencePoolPriceX96() will show incorrect price for negative tick deltas in current implementation cause it doesn't round up for them

V3Oracle TWAP tick computation truncates toward zero instead of flooring for negative tick deltas, returning inflated prices that misvalue loans and skew health checks.

- Payout: Contest reward
- Severity: high
- Program: Revert Lend
- Credited: Bauchibred
- Disclosed: 2024-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-03-revert-lend-findings/issues/127
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AH-05
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:incomplete-fix technique:source-review vuln:oracle-manipulation vuln:precision-loss

**Target:** V3Oracle._getReferencePoolPriceX96 TWAP price oracle
**Root cause:** Tick delta (tickCumulatives[0]-tickCumulatives[1])/twapSeconds is computed with Solidity integer division that truncates toward zero; for negative deltas with a nonzero remainder the tick rounds up instead of down, unlike Uniswap's OracleLibrary which decrements the tick.
**Steps:**
1. Read V3Oracle._getReferencePoolPriceX96: secondsAgos[0]=0, secondsAgos[1]=twapSeconds, then tick = int24((tickCumulatives[0]-tickCumulatives[1])/int56(uint56(twapSeconds))).
2. Compare to Uniswap OracleLibrary which uses secondsAgos[0]=secondsAgo, secondsAgos[1]=0 and applies `if (tickCumulativesDelta < 0 && (tickCumulativesDelta % secondsAgo != 0)) timeWeightedTick--;`.
3. Construct a pool state where tickCumulatives[0]-tickCumulatives[1] is negative and not divisible by twapSeconds.
4. Observe returned tick is one greater than the correct floored tick, yielding an inflated sqrtPriceX96 and price.
5. Trace impact: _checkLoanIsHealthy -> getValue -> _getReferenceTokenPriceX96 -> _getTWAPPriceX96 -> _getReferencePoolPriceX96, and Automator._getTWAPTick/_hasMaxTWAPTickDifference.
**How found:** Author compared Revert's TWAP tick derivation against Uniswap V3 OracleLibrary and noticed the missing negative-delta rounding-down branch, then traced all callers of _getReferencePoolPriceX96 to assess impact.
**Exploitation:** No concrete attack flow given; the text argues a manipulated/incorrect TWAP price could let unhealthy positions appear healthy (blocking liquidation) or wrongly gate borrow/transform/decreaseLiquidityAndCollect and AutoCompound swap enablement.
**Insight:** When reimplementing Uniswap V3 TWAP math, check the sign handling of the tick-cumulative division: Solidity truncates toward zero, so negative deltas need an explicit decrement to match OracleLibrary's floor behavior.