# Wrong Price will be Returned When Asset is PToken for WstETH

Ironbank's PriceOracle returns stETH/USD instead of wstETH-adjusted price for PToken-wstETH collateral, mispricing collateral and enabling over-borrowing or unfair liquidations.

- Payout: Contest reward
- Severity: medium
- Program: Ironbank
- Credited: branch_indigo
- Disclosed: 2023-05-24
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-05-ironbank-judging/issues/220
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-05-ironbank%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** PriceOracle.sol getPrice() / _setAggregators()
**Root cause:** getPrice() special-cases only the raw wsteth address for the stETH->wstETH conversion; a PToken wrapping wstETH has a different address, so the branch is bypassed and the chainlink aggregator (stETH/USD) is returned directly.
**Steps:**
1. Create a PToken market whose underlying asset is wstETH.
2. Call `getPrice(pTokenAddress)`; `asset == wsteth` is false so the wstETH conversion branch is skipped.
3. Oracle falls through to `aggregators[asset]` and returns the stETH/USD chainlink price.
4. Since wstETH:stETH is not 1:1, the returned price is wrong for the PToken collateral.
**How found:** Code reading of getPrice(): noticed the wstETH special-case keys on the raw wsteth address, then reasoned that a PToken wrapper address would bypass it and hit the generic aggregator path lacking a direct wstETH feed.
**Exploitation:** Mispriced PToken-wstETH collateral lets a user over-borrow against inflated collateral value or be unfairly liquidated; no concrete attack sequence given.
**Insight:** When an oracle special-cases a token address for multi-hop pricing, check every wrapper/derivative (PToken, cToken, aToken) that can be used as collateral—address-keyed branches silently miss wrapped variants.