# Incorrect scaling of the spot price

Incorrect scaling in BalancerSpotPrice returns spot price in wrong decimals, causing manipulation check to revert or miss manipulation, risking asset loss.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: mstpr-brainbot
- Disclosed: 2023-10-09
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-10-notional-judging/issues/79
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AH-2
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** BalancerComposableAuraVault.sol and BalancerSpotPrice.sol
**Root cause:** The spot price returned from StableMath._calcSpotPrice is in 18 decimals, but the code multiplies by scalingFactors[primaryIndex] instead of dividing, resulting in a spot price scaled by 1e12 for USDC/DAI pool.
**Steps:**
1. Deploy or use a Balancer composable pool with USDC (6 decimals) and DAI (18 decimals).
2. Call `_checkPriceAndCalculateValue` in BalancerComposableAuraVault.
3. Observe that `getComposableSpotPrices` returns spotPrice[DAI] = 1e12 * 1e18 instead of 1e18.
4. The subsequent scaling to POOL_PRECISION leaves it unchanged, causing a large discrepancy with oracle price.
5. The manipulation check reverts or fails to detect manipulation.
**How found:** The auditors reviewed the code and noticed that the comment states spot prices are returned in native decimals, but the scaling logic in `_calculateStableMathSpotPrice` multiplies by scaling factors instead of dividing, leading to incorrect decimals.
**Exploitation:** An attacker can manipulate the Balancer pool to create a large imbalance. Due to the incorrect spot price scaling, the vault's manipulation check either reverts (denial of service) or fails to detect the manipulation, allowing the attacker to execute trades at manipulated prices and drain funds from the vault.
**Escalation:** The incorrect spot price affects `convertStrategyToUnderlying`, which is used by Notional V3 to compute collateral values and health factors. If the manipulation check fails, the attacker can inflate collateral values and potentially drain the main protocol.
**Insight:** When auditing price oracle integrations, verify that scaling factors are applied correctly: if a value is already in 18 decimals, dividing by the scaling factor (which normalizes to 18 decimals) is needed to convert to native decimals, not multiplying.