# getBunniTokenPrice wrongly returns the total price of all tokens

BunniPrice.getBunniTokenPrice returns total pool reserve value instead of per-share price, mispricing Bunni tokens and risking protocol losses in RBS swaps.

- Payout: Contest reward
- Severity: high
- Program: Olympus
- Credited: Arabadzhiev
- Disclosed: 2023-11-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-11-olympus-judging/issues/198
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** PRICE submodule BunniPrice feed (getBunniTokenPrice)
**Root cause:** totalValue is returned directly without dividing by the Bunni token total supply, so the feed reports the entire position's reserve value rather than the price of one share.
**Steps:**
1. Read BunniPrice.sol getBunniTokenPrice (L110-166).
2. Observe totalValue computed from pool reserves is returned as-is.
3. Compare to other feeds which return per-unit price.
4. Note missing division by total supply of Bunni tokens.
5. Fix: divide totalValue by total supply to normalize per-token price.
**How found:** Code review comparing getBunniTokenPrice against other price feeds; noticed the returned value was total position value rather than per-share, spotting the missing supply division.
**Insight:** When auditing oracle/price feeds, verify the returned value is normalized per unit (divide by total supply for share-based tokens); feeds returning aggregate position value silently misprice every downstream consumer.