# Users can abuse discrepancies between oracle and true asset price to mint more OHM than needed and profit from it

Chainlink oracle deviation thresholds let users mint excess OHM via BLVaultLido deposit, then profit after oracle updates.

- Payout: Contest reward
- Severity: high
- Program: Olympus
- Credited: 0x52
- Disclosed: 2023-03-16
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-03-olympus-judging/issues/5
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-olympus%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** BLVaultLido deposit / Balancer join pool
**Root cause:** OHM mint amount is derived solely from on-chain oracle price, which can deviate from true price; EXACT_TOKENS_IN_FOR_BPT_OUT join forces all input tokens in, effectively swapping at the skewed ratio.
**Steps:**
1. Observe ohmWstethPrice from manager.getOhmTknPrice() deviates from true market price within Chainlink deviation threshold.
2. Call deposit with wstETH amount_; contract computes ohmMintAmount = amount_ * ohmWstethPrice / _WSTETH_DECIMALS.
3. manager.mintOhmToVault(ohmMintAmount) mints OHM at skewed price.
4. _joinBalancerPool uses joinType 1 (EXACT_TOKENS_IN_FOR_BPT_OUT), forcing all OHM and wstETH in, effectively swapping excess OHM for wstETH at pool ratio.
5. Wait for oracle to update to true price, then withdraw at profit; deficit paid by Olympus via minted OHM.
**How found:** Reviewer reasoned that Chainlink oracles have deviation thresholds between on-chain and true price, and that combining multiple oracles enlarges total discrepancy; then read BLVaultLido deposit and _joinBalancerPool to see mint amount uses only oracle price and join type 1 forces all tokens in.
**Exploitation:** Attacker times deposit when oracle price is favorable vs true price, mints excess OHM, joins Balancer pool forcing swap of excess OHM into wstETH, then withdraws after oracle converges, capturing the discrepancy as profit funded by Olympus minting.
**Escalation:** Multiple oracles with independent deviation thresholds compound the total discrepancy, widening the exploitable window.
**Insight:** When a protocol mints/shares based on an oracle price but then deposits into an AMM with EXACT_TOKENS_IN_FOR_BPT_OUT, the forced swap converts oracle deviation into free value; check join/exit types and whether mint uses min(oracle, pool) price.