# `LenderCommitmentGroup_Smart` picks the wrong Uniswap price, allowing borrowing at a discount by swapping before withdrawing

LenderCommitmentGroup_Smart picks min instead of max Uniswap price for token0 principal, letting borrowers manipulate the pool and borrow nearly free.

- Payout: Contest reward
- Severity: high
- Program: Teller
- Credited: 0x73696d616f
- Disclosed: 2024-04-18
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/109
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-7
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** LenderCommitmentGroup_Smart collateral pricing via Uniswap TWAP/spot
**Root cause:** _getCollateralTokensAmountEquivalentToPrincipalTokens uses Math.min when principalTokenIsToken0 and Math.max otherwise, inverting the intended worst-case price selection so the borrower gets the favorable price.
**Steps:**
1. Deploy LenderCommitmentGroup_Smart with a Uniswap pool where principal token is token0.
2. Call acceptCommitmentWithRecipient to borrow; observe pairPriceWithTwap, pairPriceImmediate, worstCasePairPrice logs.
3. Confirm worstCasePairPrice equals the borrower-favorable (lower) price, yielding lower collateral requirement.
4. Flashloan on another pool, swap in the protocol's pool to skew ratio, borrow at discount, repay flashloan.
**How found:** Code review of the collateral calculation: noticed the comment 'if this is lower, collateral tokens amt will be higher' contradicts the min/max choice, and reasoned that collateralAmount = price * principal requires max when principal is token0.
**Exploitation:** Borrower flashloans tokens, swaps in the Uniswap pool used by LenderCommitmentGroup_Smart to skew the ratio, then borrows principal with minimal collateral due to the inverted price selection, repaying the flashloan and leaving LPs with bad debt.
**Insight:** When a contract claims to pick the 'worst' price for the user, verify the direction of the min/max against how the price is actually used (multiply vs divide) — comments often reveal the intended but inverted logic.