# Rely On Balancer Oracle Which Is Not Updated Frequently

Notional's MetaStable2 vault prices stETH/ETH from a Balancer TWAP oracle updated only ~1.5x/day, so stale prices misvalue collateral and enable over-borrowing or wrongful liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Notional
- Credited: xiaoming90
- Disclosed: 2022-09-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-09-notional-judging/issues/67
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-09-notional%3AM-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:liquidation vuln:oracle-manipulation

**Target:** Balancer leverage vault oracle (TwoTokenPoolUtils._getOraclePairPrice / BalancerUtils._getTimeWeightedOraclePrice)
**Root cause:** The vault derives the stETH/ETH pair price from a Balancer pool oracle whose TWAP only updates when a swap occurs in that pool; the pool averaged ~1.5 tx/day, so the price can be up to ~16h stale and diverge from market value.
**Steps:**
1. Identify the Balancer pool polled for PAIR_PRICE: `0x32296969Ef14EB0c6d29669C550D4a0449130230`.
2. Count pool transactions over recent days (5 Oct: 3, 4 Oct: 1, 3 Oct: 1, 2 Oct: 2, 1 Oct: 1) — ~1.5/day.
3. Note `_getTimeWeightedOraclePrice` calls `IPriceOracle(pool).getTimeWeightedAverage` with `ago=0`, so the TWAP reflects only the last swap.
4. Observe `_getOraclePairPrice` blends this stale Balancer price at 60% weight with Chainlink at 40%.
5. Feed the blended price into `_convertStrategyToUnderlying` used by settlement, deleverage/liquidation, and borrowing.
**How found:** Researcher read the oracle code path, identified the specific Balancer pool, then pulled on-chain transaction counts per day to show the TWAP updates only ~1.5 times daily — reasoning that a rarely-traded pool yields a stale price.
**Exploitation:** No direct attack described; the stale/overvalued price could let a user over-borrow against overvalued collateral, or cause premature liquidation/deleverage of accounts near the threshold, and amplify slippage during vault settlement.
**Escalation:** Impact amplified because the price feeds almost all vault functions and settlement handles large asset volumes, magnifying small price errors.
**Insight:** When a protocol blends a DEX TWAP with Chainlink, check the actual swap frequency of the specific pool: a low-activity pool's TWAP is effectively the last trade price, so weight and window choices determine how stale the composite price can be.