# SpotHedgeBaseMaker LPs will be able to extract value during a USDT/USDC de-peg

SpotHedgeBaseMaker values LP shares using base/USD oracle, ignoring USDT de-peg, letting early withdrawers over-redeem base tokens at other LPs' expense.

- Payout: Contest reward
- Severity: medium
- Program: Perpetual
- Credited: IllIllI
- Disclosed: 2024-02-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-perpetual-judging/issues/118
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-perpetual%3AM-7
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** SpotHedgeBaseMaker vault withdraw/share pricing
**Root cause:** Vault value is converted to base-token units using the market's base/USD Pyth price, not a base/USDT price, so collateral de-peg is not reflected in share value.
**Steps:**
1. Deposit USDT collateral into SpotHedgeBaseMaker LP.
2. USDT de-pegs (e.g. 30%) but Pyth base/USD oracle unchanged.
3. Call `withdraw()`; `_getPrice()` returns base/USD price via `PythOracleAdapter.getPrice`.
4. `_getVaultValueInBaseSafe(vault, price)` over-values vault; `withdrawnBaseAmount = vaultValueInBase.mulWad(redeemedRatio)` over-pays base tokens.
5. Early withdrawers extract excess base tokens, leaving less for remaining LPs.
**How found:** Read README stating USDT/USDC collateral and Pyth single USD oracle per stablecoin; traced withdraw() share valuation to `_getPrice()` returning base/USD, spotting missing quote-token conversion.
**Exploitation:** During a large USDT de-peg, LPs front-run others by withdrawing first; share redemption uses inflated base/USD price so each share redeems more base tokens than its true de-pegged value, draining value from remaining LPs.
**Escalation:** Same pattern applies to wrapped/bridged tokens (WETH vs ETH) where hedging token oracle differs from market oracle.
**Insight:** When a protocol prices LP shares or collateral with a single USD oracle but accepts a stablecoin or wrapped asset as collateral, check whether the quote-token/USD leg is missing—de-peg or wrapper discount becomes free arbitrage for first withdrawers.