# IchiLpOracle is extemely easy to manipulate due to how IchiVault calculates underlying token balances

IchiLpOracle trusts IchiVault.getTotalAmounts, which prices LP positions off manipulable Uniswap V3 slot0, letting attackers skew LP valuation and drain Blueberry.

- Payout: Contest reward
- Severity: high
- Program: Blueberry
- Credited: carrot
- Disclosed: 2023-02-01
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-blueberry-judging/issues/20
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AH-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:flash-loan vuln:oracle-manipulation

**Target:** IchiLpOracle / IchiVault LP valuation oracle
**Root cause:** IchiVault._amountsForLiquidity derives underlying token amounts from UniV3Pool.slot0 (spot price) rather than a TWAP, and IchiLpOracle consumes those values directly, so a single-block price move changes the LP's reported value.
**Steps:**
1. Read IchiVault._amountsForLiquidity: it calls IUniswapV3Pool(pool).slot0() to get sqrtRatioX96 and computes amounts via UV3Math.getAmountsForLiquidity.
2. Observe IchiLpOracle.getPrice reads vault.getTotalAmounts() and uses those token amounts for valuation.
3. In one transaction, execute a large swap on the underlying UniV3 pool to move slot0's sqrtRatioX96.
4. Immediately call the Blueberry function that consumes IchiLpOracle (borrow/leverage) while the manipulated LP value is reported.
5. Reverse the swap to restore price, capturing the difference between manipulated and true LP valuation.
**How found:** Code review of IchiVault's balance calculation revealed reliance on slot0 spot price; traced into IchiLpOracle which consumes getTotalAmounts directly, flagging single-block manipulability.
**Exploitation:** Attacker flash-swaps the underlying UniV3 pool to shift slot0, then interacts with Blueberry's leverage/borrow logic that prices collateral via IchiLpOracle, borrowing against an inflated LP value or forcing losses on the protocol, then unwinds the swap.
**Escalation:** Leverage amplifies the mispricing: inflated collateral value lets attacker borrow more than the LP is worth, compounding protocol loss.
**Insight:** When an oracle delegates valuation to an external vault's getTotalAmounts, check whether that vault prices positions off slot0/spot reserves rather than TWAP — LP-collateral oracles are a recurring single-block manipulation target.