# Price could have a max drop even if it has oversold

Doppler's dutch-auction bonding curve drops price maximally when epoch netSold<=0, ignoring cumulative oversold volume, crashing token price.

- Payout: Contest reward
- Severity: high
- Program: Doppler
- Credited: deadrosesxyz
- Disclosed: 2025-02-18
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_doppler.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Adoppler%3A3.1.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Dutch-auction bonding curve hook (Uniswap v4 pool)
**Root cause:** Price adjustment checks epoch-to-epoch netSold first; if netSold<=0 it applies max tick delta without considering that cumulative tokens sold exceed expected quota for future epochs.
**Steps:**
1. Warp to end of epoch 1; buy expectedAmountSold for epoch 3 quota (oversold).
2. Warp to epoch 2; buy 1 wei then sell 1 wei (or buy nothing) so netSold<=0.
3. Warp to epoch 3; observe currentTick dropped ~800 ticks before next buy.
4. Buy 1 wei and confirm tick remains at the crashed level.
**How found:** Code review of the bonding curve adjustment logic: noticed the netSold<=0 branch short-circuits before the expectedAmountSold comparison, so cumulative oversold state is ignored.
**Exploitation:** Attacker accumulates tokens early to oversell future epochs, then in a subsequent epoch executes a tiny buy/sell (or nothing) to force netSold<=0, triggering max downward tick adjustment; new buyers acquire tokens at drastically lower price, crashing token economics.
**Insight:** In epoch-based bonding curves, check whether the per-epoch delta branch can override cumulative supply state; a single zero/negative-net epoch can reset price even when aggregate demand is far ahead of schedule.