# M-03 YTokenOracle doesn't account for losses when pricing the yToken

YTokenOracle prices yTokens at 10**decimals ignoring Yearn withdrawal losses, letting attackers over-borrow then self-liquidate at protocol expense.

- Payout: Contest reward
- Severity: medium
- Program: Sentiment
- Credited: GalloDaSballo
- Disclosed: 2022-08-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-08-sentiment-judging/tree/main/204-M
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-08-sentiment%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:liquidation vuln:oracle-manipulation

**Target:** Yearn yToken price oracle (YTokenOracle.getPrice)
**Root cause:** getPrice assumes 10**decimals yTokens equal fully liquidatable underlying, but Yearn V2 withdrawals can incur strategy losses charged to the caller, so real liquidatable value is lower.
**Steps:**
1. Identify a Yearn vault whose strategies can lose value on withdraw (levered AAVE/COMP etc.)
2. Borrow up to 100% of token value since oracle quotes 10**decimals price
3. Deliberately get liquidated so protocol withdraws from the vault and eats the loss
4. Attacker keeps borrowed value exceeding what was actually liquidatable
**How found:** Code review of YTokenOracle.getPrice noting it prices 10**decimals without accounting for Yearn V2 withdraw loss logic in Vault.vy.
**Exploitation:** Attacker borrows full oracle-quoted value against yToken collateral, then triggers self-liquidation; protocol's withdrawal from the Yearn vault incurs a strategy loss, leaving the protocol short while attacker exits with excess value.
**Escalation:** Self-liquidation withdrawal can imbalance a liquidity pool the vault uses, creating an additional arbitrage opportunity.
**Insight:** When an oracle prices a yield-bearing/lending receipt token, check whether redemption can realize losses (strategy losses, slippage, illiquid exits) that make the quoted 1:1 price unachievable at liquidation scale.