# Token amounts are scaled up twice causing the amounts to be inflated in two token vault

Notional's Balancer vault double-scales sub-18-decimal token amounts, inflating balances and breaking spot-price checks so reinvest reverts and vault users lose yield.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: xiaoming90
- Disclosed: 2022-12-20
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-12-notional-judging/issues/13
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-12-notional%3AH-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** Balancer two-token leverage vault math (Stable2TokenOracleMath)
**Root cause:** _validateSpotPriceAndPairPrice normalizes amounts to 1e18, then _getSpotPrice applies the Balancer scale factor again, so tokens with <18 decimals get scaled twice and balances are inflated.
**Steps:**
1. Pass 100 USDC (100e6) as primaryAmount into `_validateSpotPriceAndPairPrice`.
2. Line 123 scales it: `100e6 * 1e18 / 1e6 = 100e18`.
3. Line 25 scales again: `100e18 * 1e30 / 1e18 = 1e30` (= 1e12x inflated).
4. Inflated balances feed `StableMath._calcSpotPrice`, producing a deviated spot price.
5. `_checkPriceLimit` fails, reverting `_validateSpotPriceAndPairPrice` and thus `MetaStable2TokenAuraHelper.reinvestReward`.
**How found:** Code reading of the scaling logic: noticed amounts normalized to BALANCER_PRECISION in the caller, then re-scaled by scale factor inside _getSpotPrice, and traced Balancer's scaling-factor semantics (1e18 * 10**decimalsDifference) to confirm double scaling.
**Exploitation:** Not attacker-driven; the inflated spot price causes the price-limit check to revert, permanently breaking the vault's reinvest path so rewards are not compounded and strategy token value stagnates.
**Insight:** When a helper normalizes amounts to 1e18 before calling Balancer-style math, check whether the callee already applies scale factors; Balancer scale factors embed FixedPoint.ONE, so pre-normalizing causes a 10**(18-decimals) inflation.