# Spot price in share and reward math

Share, NAV or reward math reading manipulable AMM reserves or spot price instead of a TWAP or sound oracle

_Area: DeFi accounting and math bugs. Seen in 23 disclosed reports; latest 2026-09-30. Updated 2026-10-22._

## How it works
Share, NAV or reward math assumes the price or reserve it reads reflects fair value. When that input is a raw AMM slot0 price, a live reserve, or a spot virtual price, a single actor can move it within one transaction (flash loan, swap, donate, permissionless stake). The accounting then mints, redeems or pays out against a value that never existed, and the difference is real value leaving the contract.

## Where it shows up
- Mint/redeem sizing that values one leg at raw slot0 (sqrtPriceX96^2) while another leg uses Chainlink [E1](https://bugbountylibrary.com/r/dhl%3A20260930-positionmanager.md)
- Reward index computed from an AMM reserve, with accrual and payout reading it at different moments [E2](https://bugbountylibrary.com/r/dhl%3A20260929-lpbonus.md)
- NAV pricing an external LP position at spot get_virtual_price() with no time-weighting [E3](https://bugbountylibrary.com/r/dhl%3A20260916-flamincome.md)
- NAV summing external totalAssets() where an ark counts a depegged asset at par, or an empty ark can be donated into [E4](https://bugbountylibrary.com/r/dhl%3A20260706-summerfi.md)
- Tax or price logic comparing pair balances to reserves, plus unauthenticated sync/donate functions [E5](https://bugbountylibrary.com/r/dhl%3A20260529-ysdao.md)
- Dividend math from a pool balance/token ratio that donate-then-buy can inflate [E6](https://bugbountylibrary.com/r/dhl%3A20250619-bankrollnetwork.md)
- Redemption formula with a hard branch on a ratio a user action can push across [E7](https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AH-10.md)
- Ported Uniswap math deriving sqrtPriceX96 from a floored tick instead of stored price [E8](https://bugbountylibrary.com/r/c4%3A2024-08-superposition%3AM-03.md)

## How to review
Identify every price, reserve or ratio feeding share/reward math. The invariant: no value used to size mint, redeem or payout may be moved by a single actor within one transaction, and accrual and payout must read the same source at the same moment. Check each input is a TWAP, a sound oracle, or a stored value not derivable from manipulable state. For NAV sums, confirm no component prices an illiquid/depegged asset at par and no empty component can be donated into. For ratio branches, confirm no user action crosses the threshold.

## Variants seen
- Mixed oracle: sound leg plus raw-spot leg [E1](https://bugbountylibrary.com/r/dhl%3A20260930-positionmanager.md)
- Reserve read at accrual vs withdrawal [E2](https://bugbountylibrary.com/r/dhl%3A20260929-lpbonus.md)
- Spot virtual price plus permissionless stakeFor [E3](https://bugbountylibrary.com/r/dhl%3A20260916-flamincome.md)
- Depegged collateral at par plus empty-ark donation [E4](https://bugbountylibrary.com/r/dhl%3A20260706-summerfi.md)
- Spoofable balance-vs-reserve tax check with unauthenticated sync [E5](https://bugbountylibrary.com/r/dhl%3A20260529-ysdao.md)
- Donate-then-buy dividend inflation [E6](https://bugbountylibrary.com/r/dhl%3A20250619-bankrollnetwork.md)
- Threshold branch flipped by minting the other token [E7](https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AH-10.md)
- Floored-tick sqrt price instead of stored slot0 [E8](https://bugbountylibrary.com/r/c4%3A2024-08-superposition%3AM-03.md)

## Impact and severity
Losses ranged from ~19.5K USDT [E5](https://bugbountylibrary.com/r/dhl%3A20260529-ysdao.md) and 24.5 WBNB [E6](https://bugbountylibrary.com/r/dhl%3A20250619-bankrollnetwork.md) to ~$92.6K [E2](https://bugbountylibrary.com/r/dhl%3A20260929-lpbonus.md), ~$345.9K [E3](https://bugbountylibrary.com/r/dhl%3A20260916-flamincome.md), 32,080 USDT [E1](https://bugbountylibrary.com/r/dhl%3A20260930-positionmanager.md) and ~$6M [E4](https://bugbountylibrary.com/r/dhl%3A20260706-summerfi.md). Severity is high: direct fund drain. Worse when the manipulable input is the only guard, when a depegged asset is valued at par, and when permissionless functions let anyone move the input.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260930-positionmanager.md
- E2: https://bugbountylibrary.com/r/dhl%3A20260929-lpbonus.md
- E3: https://bugbountylibrary.com/r/dhl%3A20260916-flamincome.md
- E4: https://bugbountylibrary.com/r/dhl%3A20260706-summerfi.md
- E5: https://bugbountylibrary.com/r/dhl%3A20260529-ysdao.md
- E6: https://bugbountylibrary.com/r/dhl%3A20250619-bankrollnetwork.md
- E7: https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AH-10.md
- E8: https://bugbountylibrary.com/r/c4%3A2024-08-superposition%3AM-03.md