# Corrupted oracle system if more than 2 underlying tokens are used and one of them is WSTETH

Mellow's ChainlinkOracle forces cross-oracle pricing, so adding a second underlying token alongside wstETH misprices wstETH as stETH, causing incorrect LP minting and user fund loss.

- Payout: Contest reward
- Severity: medium
- Program: Mellow
- Credited: eeyore
- Disclosed: 2024-06-04
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-mellow-judging/issues/266
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-mellow%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** ChainlinkOracle priceX96() oracle adapter in Mellow LRT vaults
**Root cause:** priceX96() always enforces a cross-oracle price check (Z/Y -> Y/X) and cannot use a direct Chainlink feed, so with wstETH as first underlying the base token effectively becomes stETH and ConstantAggregatorV3 treats 1 stETH = 1 WETH.
**Steps:**
1. Deploy/use live Steakhouse vault 0xBEEF69Ac7870777598A04B2bd4771c71212E6aBc with WETH base token and wstETH via WStethRatiosAggregatorV3
2. Call `vault.addToken(rETH)` and update ratios 50/50 via `ratiosOracle.updateRatios`
3. Call `priceOracle.setChainlinkOracles` with WETH->ConstantAggregatorV3 and rETH->rETH/ETH Chainlink feed
4. User deposits 50 wstETH + 50 rETH via `vault.deposit`
5. Observe wstETH priceX96 computed in stETH but treated as WETH, overvaluing vault and under-minting LP (~0.043 ETH loss)
**How found:** Code review of ChainlinkOracle.priceX96() noting it always requires a base token and cross-price query; traced live Steakhouse vault config (WETH base + ConstantAggregatorV3, wstETH via WStethRatiosAggregatorV3) and reasoned that any addToken() breaks pricing.
**Exploitation:** Admin adds a second underlying token to a wstETH vault; oracle misconfiguration causes wstETH to be valued at stETH parity, so depositors receive fewer LP shares than fair value, leaking value to existing holders.
**Insight:** When an oracle adapter forces a single base token for all assets, check whether tokens lacking a direct pair to that base get silently routed through a constant 1:1 aggregator; adding any second asset then misprices the first.