# CurveTricryptoOracle#getPrice contains math error that causes LP to be priced completely wrong

CurveTricryptoOracle.getPrice divides an already-USD LP price by ETH price, returning ETH-denominated value and undervaluing LPs so healthy positions get liquidated.

- Payout: Contest reward
- Severity: high
- Program: Blueberry
- Credited: 0x52
- Disclosed: 2023-07-12
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-07-blueberry-judging/issues/100
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-07-blueberry%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:liquidation vuln:oracle-manipulation

**Target:** CurveTricryptoOracle price oracle contract
**Root cause:** The oracle was copied from Sentiment's version that intentionally returns price in ETH; here the LP price is already computed in USD but still divided by ethPrice, yielding an ETH-denominated value.
**Steps:**
1. Read CurveTricryptoOracle.getPrice lines 57-62: `(lpPrice(virtualPrice, base.getPrice(tokens[1]), ethPrice, base.getPrice(tokens[0])) * 1e18) / ethPrice`
2. Note lpPrice already returns USD valuation of the LP
3. Observe the extra `/ ethPrice` converts result to ETH terms
4. Compare against intended USD oracle semantics; result is massively undervalued LP
**How found:** Code review of the oracle against its source (Sentiment's CurveTriCryptoOracle) revealed the borrowed code was designed to return ETH-denominated price, but Blueberry's oracle is meant to return USD, making the division erroneous.
**Exploitation:** Oracle returns LP price in ETH instead of USD, so collateral value is understated; positions that are actually over-collateralized appear under-collateralized and can be liquidated by any liquidator.
**Insight:** When an oracle is forked from another protocol, verify the unit/denomination contract of the original (ETH vs USD) matches the new consumer's expectation; a leftover normalization step silently misprices collateral.