# PythOracle:if price.expo is less than 0, wrong prices will be recorded

PythOracle._recordPrice mishandles negative Pyth price exponents, recording 5e-5 as 5e5 and inverting price ordering, corrupting oracle prices.

- Payout: Contest reward
- Severity: high
- Program: Perennial
- Credited: Emmanuel
- Disclosed: 2023-07-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-07-perennial-judging/issues/56
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AH-4
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** PythOracle.sol _recordPrice price conversion
**Root cause:** The code takes the absolute value of price.expo and multiplies instead of dividing, so negative exponents scale the price up rather than down.
**Steps:**
1. Read PythOracle._recordPrice: `Fixed6Lib.from(price.price).mul(Fixed6Lib.from(10 ** abs(price.expo)))`
2. Note expo sign is discarded via `price.expo > 0 ? price.expo : -price.expo`
3. For price 5e-5 (price=5, expo=-5), result is 5 * 10^5 = 5e5 instead of 5e-5
4. Observe ordering inversion: 5e-5 recorded as 5e5 while 5e-6 recorded as 5e6, flipping relative magnitude
**How found:** Code review of the exponent handling in _recordPrice, noticing the absolute-value ternary discards the sign and multiplies instead of dividing.
**Insight:** When integrating oracle feeds, verify exponent sign handling: Pyth prices are price*10^expo, so negative expo requires division; taking abs(expo) and multiplying silently inverts magnitudes.