# Composable pools can be calculated incorrectly

BPTOracle misprices Balancer composable pools by multiplying min asset price by pool rate, overvaluing wstETH/aETHc LP tokens ~11.7% and causing depositor losses.

- Payout: Contest reward
- Severity: high
- Program: Opal
- Credited: bronzepickaxe
- Disclosed: 2024-03-30
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_opal_feb2024.pdf#3.2.12
- Library page: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.12
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** BPTOracle.sol BptPriceComposablePool price oracle
**Root cause:** Composable pool price is computed as min(assetPrice)*poolRate/1e18, which ignores the pool's actual token composition/weights and thus diverges from the real LP token value.
**Steps:**
1. Call `BPTOracle.BptPriceComposablePool(poolId)` for a wstETH/aETHc Balancer composable pool
2. Observe `getRate()` returns ~1.016 (1015874971542880280)
3. Oracle computes minPrice (~3217) * poolRate (~1.015) = ~3265.255
4. Compare to actual LP token price ~2922.45, showing ~11.7% overvaluation
**How found:** Auditor read the BptPriceComposablePool calculation, noticed it multiplies min asset price by pool rate without accounting for pool composition, then manually compared computed price against actual LP token price for a wstETH/aETHc pool.
**Exploitation:** Users routed into depositing into the mispriced pool lose ~11.7% of funds instantly due to overvaluation; TVL display is also incorrect, affecting other pools and the whole protocol.
**Insight:** For composable/linear Balancer pools, getRate() is not a simple multiplier on the min asset price; verify oracle math against the actual LP token market price on a real pool before trusting the formula.