# LibUbiquityPool::mintDollar/redeemDollar reliance on outdated TWAP oracle may be inefficient for preventing depeg

Ubiquity's mint/redeem uses a stale Curve metapool TWAP because the metapool's internal update isn't called, allowing mint/redeem outside intended price thresholds and potential value extraction.

- Payout: Contest reward
- Severity: medium
- Program: Ubiquity
- Credited: 0xadrii
- Disclosed: 2023-12-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-ubiquity-judging/issues/13
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-ubiquity%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:oracle-manipulation

**Target:** LibUbiquityPool mintDollar/redeemDollar and LibTWAPOracle
**Root cause:** LibTWAPOracle.update() reads cumulative prices from the Curve metapool without first calling the metapool's internal _update(), so the TWAP reflects the last metapool action rather than current reserves.
**Steps:**
1. Attacker observes uAD price at $0.99, then a trade pushes it to $1.01; no further metapool trades occur.
2. LUSD oracle price drifts to $0.99 while TWAP remains $1.01.
3. Attacker deposits 1M LUSD to mint 1M uAD (allowed because TWAP > $1.01 threshold).
4. Attacker triggers a metapool update (e.g., via a small trade) and the Chainlink oracle heartbeat updates LUSD to $0.99.
5. Attacker redeems 1M uAD for ~1.01M LUSD, profiting ~$10k.
**How found:** Code review of LibTWAPOracle.update() revealed it reads cumulative prices from the Curve metapool without invoking the metapool's internal _update(), leading to stale TWAP values.
**Exploitation:** Attacker mints uAD when stale TWAP incorrectly signals price above threshold, then redeems after updating the metapool and oracle to realize profit from the price discrepancy.
**Insight:** When integrating a TWAP oracle from an external pool, verify whether the pool's cumulative prices require an explicit update call; otherwise the TWAP may reflect only the last pool action, not current reserves.