# Whenever swapPrice > oraclePrice, minting via PositionManager will revert, due to not enough funds being obtained from user.

PositionManager computes premium from oracle price only, but DVP charges max(swap, oracle) premium, so mint reverts when swapPrice > oraclePrice.

- Payout: Contest reward
- Severity: medium
- Program: Smilee Finance
- Credited: cawfree
- Disclosed: 2024-02-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-smilee-finance-judging/issues/32
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-smilee-finance%3AM-3
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** PositionManager.mint / DVP.premium (Solidity contracts)
**Root cause:** PositionManager obtains obtainedPremium from DVP::premium() which uses only oracle price, while DVP::_getMarketValue charges the greater of swapPrice and oraclePrice premiums, so the collected amount can be less than required.
**Steps:**
1. Call PositionManager.mint() with params where swapPrice > oraclePrice.
2. PositionManager queries dvp.premium(strike, notionalUp, notionalDown) which returns premium based on oracle price only.
3. PositionManager transfers obtainedPremium to DVP.
4. DVP computes premium_ = max(premiumSwap, premiumOrac) > obtainedPremium.
5. DVP's safeTransferFrom(msg.sender, vault, premium_ + vaultFee) reverts due to insufficient balance.
**How found:** Code reading: compared how obtainedPremium is computed in PositionManager (via DVP::premium using oracle price) against the actual premium charged in DVP::_getMarketValue which takes max of swap and oracle premiums, spotting the mismatch.
**Exploitation:** Any user minting via PositionManager when swapPrice exceeds oraclePrice triggers a revert; no value extraction, pure DoS of core minting path.
**Insight:** When a periphery contract pre-computes a payment amount via a view helper, verify the core contract's actual charge path uses the same formula; look for max/min selection between oracle and swap prices that the helper omits.