# Stable BPT valuation is incorrect and can be exploited to cause protocol insolvency

StableBPTOracle prices Balancer stable BPT as min constituent price times pool rate, overvaluing LP ~12% and enabling overborrowing to insolvency.

- Payout: Contest reward
- Severity: high
- Program: Blueberry
- Credited: 0x52
- Disclosed: 2023-07-12
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-07-blueberry-judging/issues/97
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** StableBPTOracle price oracle for Balancer stable pools
**Root cause:** Oracle applies Curve-style stable LP pricing (min constituent price * pool.getRate()) to Balancer pools, which do not value LP that way, so the returned price diverges from actual LP value.
**Steps:**
1. Read `StableBPTOracle.sol#L48-L53`: computes `minPrice` over `base.getPrice(tokens[i])` then returns `minPrice.mulWadDown(pool.getRate())`.
2. Compare against a real pool, e.g. wstETH/aETHc: `getRate()`=1.006, min price aETHc=2073.23, oracle LP value=2085.66.
3. Check actual LP value on apy.vision: 1870.67, i.e. ~12% overvaluation.
4. Borrower deposits overvalued BPT as collateral and borrows against inflated value.
**How found:** Code review of the oracle's pricing formula; recognized it mirrors Curve stable LP pricing and tested it against a live Balancer wstETH/aETHc pool, comparing oracle output to apy.vision's actual LP value to expose the gap.
**Exploitation:** Borrower supplies the overvalued stable BPT as collateral; because the oracle reports ~12% above real value, they borrow more than the collateral is worth, leaving bad debt and protocol insolvency when the position is liquidated.
**Insight:** When an oracle reuses a known LP-pricing formula, verify the formula matches the specific AMM's invariant; Balancer weighted/stable pools do not price like Curve, so min-price*rate overvalues pools with depegged or imbalanced assets.