# Performing a direct multiplication in `_getPriceFromSqrtX96` will overflow for some uniswap pools

Teller's _getPriceFromSqrtX96 multiplies uint160 sqrtPriceX96 directly, overflowing for pools like WBTC/SHIBA and DoSing borrows.

- Payout: Contest reward
- Severity: medium
- Program: Teller
- Credited: 0x73696d616f
- Disclosed: 2024-04-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-teller-finance-judging/issues/243
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AM-14
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:dos vuln:precision-loss

**Target:** LenderCommitmentGroup_Smart Uniswap V3 price oracle
**Root cause:** uint160 sqrtPriceX96 (up to 160 bits) is squared in uint256 without FullMath.mulDiv, so values above 2^128 overflow and revert.
**Steps:**
1. Query Uniswap V3 pool slot0 for WBTC/SHIBA (0x1153C8F2B05Fdde2dB507c8D16E49d4C7405c907); sqrtPriceX96 = 380146371870332863053439965317548561928 (129 bits).
2. Call _getUniswapV3TokenPairPrice -> _getPriceFromSqrtX96 with that value.
3. Observe `uint256(_sqrtPriceX96) * uint256(_sqrtPriceX96)` exceeds 2^256 and reverts.
4. Borrow path in LenderCommitmentGroup_Smart reverts, pool unusable.
**How found:** Code review of the price helper; noticed sqrtPriceX96 is uint160 but squared directly, then checked a real pool's slot0 to confirm a 129-bit value that overflows.
**Insight:** When squaring Uniswap sqrtPriceX96, remember it is uint160 and can exceed 2^128 for high-decimal-difference pairs; always use FullMath.mulDiv, and check real pool slot0 values to prove reachability.