# Price cumulative last is used inverted in Uniswap Oracle

UniswapPriceOracle fetches the inverted cumulative price for the configured direction, so the TWAP slippage check compares against the reciprocal price and can pass when it shouldn't.

- Payout: Contest reward
- Severity: medium
- Program: Olas
- Credited: holtzzx
- Disclosed: 2026-05-18
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2026-01-olas#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** UniswapPriceOracle.sol validatePrice / Uniswap V2 pair cumulative prices
**Root cause:** The direction flag is set based on whether secondToken is token0, but the cumulative price fetched is swapped: direction==0 reads price1CumulativeLast (token0 priced in token1) instead of price0CumulativeLast, yielding the inverse of the desired OLAS/secondToken price.
**Steps:**
1. Deploy pair where secondToken == token0 so direction=0.
2. Call validatePrice(slippage): it reads price1CumulativeLast, the inverse denomination.
3. Move price from 2 to 1; oracle computes as 0.5 to 1, a 100% gain instead of a loss.
4. Slippage derivation stays within bounds and validatePrice returns true despite real divergence.
5. BuyBackBurner._buyOLAS proceeds to swap at a wrong price.
**How found:** Code-reading: noticed the @audit comment that direction==0 should use price0CumulativeLast, then reasoned through Uniswap V2 semantics (price0CumulativeLast = token1 priced in token0) and the constructor's direction assignment to confirm the inversion.
**Exploitation:** Attacker or price mover causes a real price divergence that the inverted TWAP reads as favorable; the slippage guard passes and BuyBackBurner executes the buyback at a price inverse to market, over/under-charging users.
**Insight:** When an oracle picks between price0CumulativeLast and price1CumulativeLast based on a direction flag, verify the flag's semantics against the constructor's token0 comparison—the reciprocal denomination silently inverts the TWAP and defeats slippage checks.