# Balancer LP valuation methodologies use the incorrect supply metric

Olympus SPPLY module valued Balancer LP tokens using totalSupply() instead of getActualSupply(), causing gross mispricing of POL and incorrect RBS deployment.

- Payout: Contest reward
- Severity: medium
- Program: Olympus
- Credited: 0x52
- Disclosed: 2023-11-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-11-olympus-judging/issues/155
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** AuraBalancerSupply submodule (SPPLY) LP valuation
**Root cause:** Balancer LP valuation divides pool balances by pool.balancerPool.totalSupply(), but many Balancer pool implementations report a max/initial supply via totalSupply() rather than the actual circulating supply, which is exposed via getActualSupply().
**Steps:**
1. Read AuraBalancerSupply.sol#L345-L362: balTotalSupply = pool.balancerPool.totalSupply()
2. Observe polBalance = (balance * balBalance) / balTotalSupply uses this inflated supply
3. Compare against a real pool (e.g. 0x42ed...0af7) where totalSupply() = 2,596,148,429,273,858 but actual supply is 6454.48
4. Note resulting LP valuation is orders of magnitude too low (or high) depending on pool
5. Fix: query getActualSupply() via try-catch per pool
**How found:** Code review of the LP valuation math; noticed totalSupply() is not the correct supply metric for Balancer pools and verified against a live pool where totalSupply() vastly exceeds actual supply.
**Exploitation:** Not directly weaponized; mispricing feeds the RBS pricing system, which could deploy funding at incorrect prices, buying/selling at a loss to the protocol if a sizable portion of reserves sits in an affected pool.
**Insight:** For Balancer (and similar) LP tokens, totalSupply() can return a max/initial supply rather than circulating supply — always check whether the pool exposes getActualSupply() and use it for share math; verify against on-chain values on a real pool.