# TwoTokenPoolUtils's _getOraclePairPrice produces incorrect oraclePairPrice when balancerOracleWeight is set to be bigger than BALANCER_ORACLE_WEIGHT_PRECISION

Notional's _getOraclePairPrice divides by fixed BALANCER_ORACLE_WEIGHT_PRECISION instead of balancerOracleWeight, so a misconfigured weight above 1e8 inflates strategy price up to 1e10x, causing wrong liquidations.

- Payout: Contest reward
- Severity: medium
- Program: Notional
- Credited: hyh
- Disclosed: 2022-09-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-09-notional-judging/issues/50
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-09-notional%3AM-18
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:liquidation vuln:oracle-manipulation

**Target:** Balancer leveraged vault oracle price helper (TwoTokenPoolUtils)
**Root cause:** _getOraclePairPrice normalizes the weighted sum by the constant BALANCER_ORACLE_WEIGHT_PRECISION (1e8) rather than by oracleContext.balancerOracleWeight; when the weight exceeds 1e8 the chainlink term is zeroed and the balancer term is under-divided, inflating the price.
**Steps:**
1. Read TwoTokenPoolUtils._getOraclePairPrice: balancerWeightedPrice = balancerPrice * balancerOracleWeight; chainlinkWeightedPrice only computed if balancerOracleWeight < 1e8.
2. Note final division is by BALANCER_ORACLE_WEIGHT_PRECISION (1e8), not by balancerOracleWeight.
3. Observe setStrategyVaultSettings only checks settings.balancerOracleWeight <= caller-supplied balancerOracleWeight, with no cap at 1e8.
4. Configure a vault with balancerOracleWeight = 1e18 (18-decimal precision instead of 8).
5. Call convertStrategyToUnderlying or settleVault; _getOraclePairPrice returns price ~1e10x actual oracle price.
6. Resulting inflated/deflated strategy valuation triggers wrongful liquidation or blocks healthy liquidations.
**How found:** Code-reading of the weighted-average oracle math: noticed the denominator is a hardcoded precision constant while the weight is caller-configurable, and that the chainlink branch is skipped when weight >= precision, so an out-of-range weight silently skews the result.
**Insight:** When a weighted-average formula mixes a configurable weight with a hardcoded precision denominator, check whether the denominator should be the weight itself; also check that config setters bound the weight to the precision the math assumes.