# price is calculated wrongly in BoundedStepwiseExponentialPriceAdapter

Operator precedence bug in BoundedStepwiseExponentialPriceAdapter computes scalingFactor*e^x - 1 instead of scalingFactor*(e^x - 1), skewing auction prices by scalingFactor-1.

- Payout: Contest reward
- Severity: medium
- Program: Index
- Credited: 0x007
- Disclosed: 2023-06-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-Index-judging/issues/39
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-Index%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** BoundedStepwiseExponentialPriceAdapter.getPrice auction price adapter
**Root cause:** Missing parentheses: `scalingFactor * expExpression - WAD` evaluates multiplication before subtraction, so the WAD offset is not scaled, yielding `scalingFactor*e^x - 1` instead of `scalingFactor*(e^x - 1)`.
**Steps:**
1. Read getPrice in BoundedStepwiseExponentialPriceAdapter.sol L40-73.
2. Note intended formula scalingFactor*(e^x - 1) but code does scalingFactor*expExpression - WAD.
3. At timeBucket=0, expExpression=WAD, so priceChange = scalingFactor - WAD instead of 0.
4. Returned price differs from intended by scalingFactor-1, shifting the whole auction curve.
5. Fix: `scalingFactor * (expExpression - WAD)` (later via wadMul).
**How found:** Code reading of the price formula; noticed missing brackets cause multiplication before subtraction, confirmed with team member.
**Insight:** When auditing fixed-point price adapters, verify operator precedence and WAD scaling in each term—an unscaled constant offset shifts the entire curve, not just one bucket.