# Stat calculator returns incorrect report for swETH

Tokemak's swETH stat calculator uses the same swETHToETHRate source as its oracle, so premium always computes to zero, feeding false rebalance signals.

- Payout: Contest reward
- Severity: high
- Program: Tokemak
- Credited: xiaoming90
- Disclosed: 2023-06-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-tokemak-judging/issues/587
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-tokemak%3AH-7
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** LST stat calculator / price oracle (SwethLSTCalculator, SwEthEthOracle)
**Root cause:** Both the swETH oracle (getPriceInEth) and the calculator (calculateEthPerToken) call the same swEth.swETHToETHRate(), so price equals backing and priceToBacking is always 1e18, making premium always zero.
**Steps:**
1. Note SwEthEthOracle.getPriceInEth returns swEth.swETHToETHRate()
2. Note SwethLSTCalculator.calculateEthPerToken returns IswETH(lstTokenAddress).swETHToETHRate()
3. In LSTCalculatorBase.current, price = getPriceInEth and backing = calculateEthPerToken are identical value x
4. priceToBacking = x*1e18/x = 1e18 always
5. premium = priceToBacking - 1e18 = 0 always, regardless of real premium/discount
**How found:** Code-reading: noticed oracle and calculator both derive price from the same swETHToETHRate function, so the ratio cancels to 1e18 and premium is structurally zero.
**Exploitation:** No direct exploit; the broken premium signal feeds the solver's composite return scoring, potentially allowing unprofitable rebalances to be executed and causing protocol losses.
**Insight:** When a stat/score contract compares an oracle price against a 'backing' value, check whether both sides resolve to the same source; if so the ratio is a constant and any premium/discount signal is dead.