# Bptoracle.bptpriceweightpool() tries to use totalsupply() to get the total supply of the pools, resulting in inaccurate bptprice

BPTOracle used totalSupply() instead of getActualSupply() for newer Balancer weighted pools, producing wrong BPT price and TVL in Omnipool.

- Payout: Contest reward
- Severity: high
- Program: Opal
- Credited: AuditorPraise
- Disclosed: 2024-03-30
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_opal_feb2024.pdf#3.2.3
- Library page: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.3
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:oracle-manipulation

**Target:** BPTOracle.sol / Omnipool.sol price oracle
**Root cause:** BPTOracle.bptPriceWeightPool() computes BPT price as TVL/totalSupply(), but newer Balancer weighted pools pre-mint BPT and require getActualSupply(); totalSupply() returns an inflated value, understating price.
**Steps:**
1. Identify a newer Balancer weighted pool using getActualSupply (e.g. `0xcf7b...a1d52a` on Aura).
2. Call `BPTOracle.bptPriceWeightPool()` on that pool; it reads `totalSupply()` instead of `getActualSupply()`.
3. Observe computed `bptPrice = numerator / totalSupply` is lower than the true price.
4. Feed result into `Omnipool._withdrawFromAuraPool()` / `getPoolTvl()` and observe misvalued TVL.
**How found:** Read Balancer docs noting totalSupply is only valid for older stable/weighted pools; checked real newer weighted pool addresses (including one on Aura) and confirmed they use getActualSupply, contradicting the code's assumption.
**Exploitation:** Not described beyond incorrect price/TVL feeding Omnipool withdrawal and TVL accounting; no concrete drain sequence given.
**Insight:** When integrating Balancer BPT pricing, verify per-pool whether it is pre-minted (getActualSupply) vs legacy (totalSupply); the split is not just composable stable pools—newer weighted pools also pre-mint.