# Curve vault will undervalue or overvalue the LP Pool tokens if it comprises tokens with different decimals

Curve vault's _getTimeWeightedPrimaryBalance adds primary and secondary balances without decimal scaling, mispricing LP tokens and enabling over-borrowing or premature liquidation.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: xiaoming90
- Disclosed: 2023-02-27
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-notional-judging/issues/8
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-notional%3AH-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation vuln:precision-loss

**Target:** Curve2TokenPoolUtils / TwoTokenPoolUtils LP valuation
**Root cause:** secondaryAmountInPrimary is computed in secondary token decimals but added directly to primaryBalance (primary decimals) before a single primaryPrecision scaling, so mixed-decimal pools produce wildly wrong values.
**Steps:**
1. Deploy vault over DAI(18)-USDC(6) Curve pool with DAI as primary.
2. Call _getTimeWeightedPrimaryBalance with poolClaim=50, totalSupply=100, 100 DAI + 100 USDC in pool, oraclePrice=1e18.
3. Observe secondaryAmountInPrimary = 50*10^6 instead of 50*10^18; primaryAmount returns ~50 DAI instead of 100 DAI.
4. Swap primary to USDC(6): secondaryAmountInPrimary = 50*10^18, primaryAmount returns ~50,000,000 USDC instead of 100 USDC.
**How found:** Code review of the shared TwoTokenPoolUtils math, noticing primaryBalance and secondaryAmountInPrimary are summed without reconciling differing token decimals.
**Exploitation:** Attacker deposits into a vault whose primary token has fewer decimals than the secondary; inflated collateral valuation lets them borrow beyond allowed limits, or a victim's undervalued position can be liquidated prematurely.
**Escalation:** Overvaluation feeds VaultConfiguration.calculateCollateralRatio, amplifying borrow capacity; undervaluation triggers premature liquidation; also corrupts expectedUnderlyingRedeemed in vault settlement.
**Insight:** In shared pool-math libraries, audit every addition of two balances for implicit decimal assumptions; mixed-decimal pools (DAI/USDC) silently break formulas that assume uniform precision.