# IchiLpOracle returns inflated price due to invalid calculation

IchiLpOracle.getPrice double-applies 1e18 scaling, returning ~1.1 trillion USD per ICHI_USDC vault token, inflating collateral and letting users over-borrow.

- Payout: Contest reward
- Severity: medium
- Program: Blueberry
- Credited: sakshamguruji
- Disclosed: 2023-02-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-blueberry-judging/issues/254
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** IchiLpOracle.getPrice LP token price oracle
**Root cause:** totalReserve is already normalized to 18-decimal USD, but the return multiplies by an extra 1e18 before dividing by totalSupply, inflating the reported price by 1e18.
**Steps:**
1. Call `IchiLpOracle.getPrice(0xFCFE742e19790Dd67a627875ef8b45F17DB1DaC6)` for the ICHI_USDC vault
2. Observe return value `1101189125194558706411110851447` (~1.1e30)
3. Interpret with 18 decimals: ~1.1 trillion USD per LP token instead of a sane price
4. Trace code: `totalReserve = r0*px0/10**t0Decimal + r1*px1/10**t1Decimal` already yields 18-decimal USD
5. Return `(totalReserve * 1e18) / totalSupply` applies an extra 1e18 scaling
**How found:** Ran the existing test suite with real vault values (mocked ICHI/USDC prices at correct decimals) and noticed the returned price was absurdly large (~1.1e30), then traced the extra 1e18 multiplication in the return statement.
**Exploitation:** Attacker deposits into the ICHI_USDC vault and uses it as collateral; the inflated oracle price makes _validateMaxLTV accept a far larger borrow than the real collateral value supports, enabling over-borrowing of Blueberry funds.
**Insight:** When an oracle normalizes reserves to 18-decimal USD internally, check whether the final return re-applies 1e18 scaling; sanity-check oracle outputs against expected magnitude in tests rather than only checking nonzero.