# Inverted oracle price direction

Check base/quote orientation, multiply vs divide, and min/max choice on every price path

_Area: DeFi oracles, liquidations and flash loans. Seen in 22 disclosed reports; latest 2026-05-18. Updated 2026-10-23._

## How it works
Price math has a direction: which asset is base, which is quote, whether a rate multiplies or divides, and whether a guard wants the best or worst price. The bug is a mismatch between the direction the code assumes and the direction the value actually has. A ratio applied after an inversion instead of before, a min where a max was intended, or a spot price quoted Y/X compared against an oracle quoted X/Y all yield a plausible-looking number that is wrong, often by the inverse factor or the peg deviation.

## Where it shows up
- Fair-LP or share-wrapper formulas where an asset/share ratio is applied outside the sqrt or after inverting the price [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AH-5.md)
- min/max selection in collateral valuation, especially with a comment claiming "worst price" [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-7.md)
- Scaling factors applied by multiply where the value is already normalized, so the result is off by a fixed power of ten [E3](https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AH-2.md)
- Derivative tokens wired to the base-asset feed with a 1:1 assumption [E4](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.17.md)
- LP oracles applying one min/max price to summed reserves instead of pricing each reserve [E5](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-06.md)
- Direction flags choosing price0 vs price1 cumulative, where the flag's semantics are inverted [E6](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-03.md)
- Conversions that divide by a USD/Token oracle rate instead of multiplying [E7](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.7.md)
- Oracle adapters forcing a single base token, routing assets through a constant 1:1 aggregator [E8](https://bugbountylibrary.com/r/sherlock%3A2024-06-mellow%3AM-4.md)

## How to review
For each price path, annotate the unit and orientation of every value and confirm they match at each operation. The invariant: the value fed into a multiply/divide, min/max, or comparison must be quoted in the same base/quote orientation and represent the same asset as the code assumes. Concrete checks: confirm wrapper ratios enter before inversion and inside the sqrt [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AH-5.md); confirm min/max matches how the price is used [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-7.md); confirm scaling is applied in the correct direction for the value's existing decimals [E3](https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AH-2.md); confirm guard and oracle share orientation [E6](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-03.md); audit every consumer of one oracle for multiply-vs-divide direction [E7](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.7.md). Triage cues: comments claiming "worst price" or "1 X = 1 Y" are high-signal.

## Variants seen
- Ratio applied in wrong order relative to inversion [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AH-5.md)
- Inverted min/max selection [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-7.md)
- Scaling factor multiplied where it should divide [E3](https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AH-2.md)
- 1:1 peg assumption for derivatives [E4](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.17.md)
- Single min/max price applied to summed reserves [E5](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-06.md)
- Inverted direction flag selecting the reciprocal cumulative price [E6](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-03.md)
- Divide where multiply was intended [E7](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.7.md)
- Forced base token routed through constant 1:1 aggregator [E8](https://bugbountylibrary.com/r/sherlock%3A2024-06-mellow%3AM-4.md)

## Impact and severity
Wrong-direction prices let borrowers over-borrow against overvalued collateral, borrow at a discount [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-7.md), bypass manipulation guards [E3](https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AH-2.md)[E6](https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-03.md), or arbitrage undervalued LP [E5](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-06.md). Silent errors (small systematic inversions [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AH-5.md)[E7](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.7.md)) are worse than loud ones (depeg spirals [E4](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.17.md)) because they escape notice. Severity is high when the mispriced value gates borrowing or minting.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AH-5.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-04-teller-finance%3AH-7.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AH-2.md
- E4: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.17.md
- E5: https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-06.md
- E6: https://bugbountylibrary.com/r/c4%3A2026-01-olas%3AM-03.md
- E7: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.1.7.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2024-06-mellow%3AM-4.md