# Price formula in `TpdaLiquidationPair._computePrice()` does not account for a jump in liquidatable balance

TpdaLiquidationPair's linearly decreasing auction price ignores sudden jumps in liquidatable balance, letting bots buy vault yield far below value.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: 0x73696d616f
- Disclosed: 2024-05-10
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-pooltogether-judging/issues/38
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-pooltogether%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** TpdaLiquidationPair._computePrice / PrizeVault.liquidatableBalanceOf
**Root cause:** Auction price decays linearly from targetAuctionPeriod*lastAuctionPrice to zero based only on elapsed time, without incorporating the current liquidatable balance, so an instantaneous increase in available balance is priced at the stale near-zero value.
**Steps:**
1. Vault sits at mint limit so liquidatableBalanceOf() returns 0; auction price decays toward ~0 over time.
2. A user withdraws, lowering totalDebt and raising _mintLimit, so liquidatableBalanceOf() jumps (e.g. to 1000e18).
3. Liquidation bot calls swap at the still near-zero price from `_computePrice()` and drains the newly liquidatable balance for almost nothing.
**How found:** Code review of the auction price formula versus the liquidatable balance computation; noticed price depends only on elapsed time while available balance can jump discontinuously via mint-limit changes or yieldFeePercentage reductions.
**Exploitation:** A liquidation bot monitors for events that raise liquidatableBalanceOf() (withdrawals reducing mint-limit constraint, or owner lowering yieldFeePercentage) and immediately swaps at the stale low auction price, capturing the vault's yield at a fraction of its value.
**Insight:** When an auction price is a function of time only, enumerate every state change that can discontinuously increase the auctioned quantity (limits, fee params, external withdrawals) and check whether the price can be stale-low at that instant.