# PerpDepository#getPositionValue uses incorrect value for TWAP interval allowing more than intended funds to be extracted

PerpDepository.getPositionValue used a 15-second TWAP instead of the intended 15-minute mark price, letting attackers rebalance more than allowed.

- Payout: Contest reward
- Severity: high
- Program: Uxd
- Credited: berndartmueller
- Disclosed: 2022-12-27
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-uxd-judging/issues/249
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AH-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** PerpDepository.getPositionValue / getMarkPriceTwap (Perp exchange integration)
**Root cause:** getPositionValue calls getMarkPriceTwap(15), passing 15 seconds instead of the 900-second (15 minute) mark price TWAP defined by Perp's ClearingHouseConfig, so the computed position value deviates from the true mark price.
**Steps:**
1. Read PerpDepository.getPositionValue: `getMarkPriceTwap(15)`
2. Compare to Perp docs/ClearingHouseConfig where mark price is a 900s TWAP
3. Observe getMarkPriceTwap forwards twapInterval to exchange.getSqrtMarkTwapX96(market, twapInterval)
4. Short TWAP makes position value track spot, diverging from true mark price
5. Attacker times rebalance when short-TWAP value exceeds true mark price to extract more funds than intended
**How found:** Code reading of getPositionValue against Perp's documented mark price definition (15-minute TWAP) revealed the hardcoded 15 was seconds, not minutes.
**Exploitation:** Attacker monitors the 15s TWAP vs the true 900s mark price; when the short TWAP is favorable, triggers a rebalance so getPositionValue overstates/understates position value, allowing more funds to be extracted than the intended limit.
**Insight:** When a protocol hardcodes a TWAP/oracle interval, cross-check the unit against the upstream oracle's documented default (seconds vs minutes); a 60x shorter window makes the value track spot and breaks any invariant that assumes mark price.