# Oracle price composition math errors

Wrong operand, order, denomination, rounding, or double-applied fee when composing oracle prices

_Area: DeFi oracles, liquidations and flash loans. Seen in 9 disclosed reports; latest 2025-01-08. Updated 2026-10-23._

## How it works
Oracle code composes several numbers into one price: per-hop prices, pool rates, rateProvider rates, weights, fees. The bug is a concrete arithmetic mistake in that composition — the wrong operand is used, operands are combined in the wrong order, a value is in the wrong denomination, signed division rounds the wrong way, or the same adjustment is applied twice. The code still returns a plausible number, so nothing reverts, and downstream consumers treat the mispriced value as authoritative.

## Where it shows up
- Multi-hop routing loops that pass the original asset instead of the running output token [E1](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-03.md)
- LP/BPT pricing that multiplies a min token price by `getRate()` without dividing by rateProvider rates [E2](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AH-3.md)
- Aggregation that sums numerators and denominators separately, computing (Σp)(Σq) instead of Σ(p·q) [E3](https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-34.md)
- Composable/linear pool pricing that treats `getRate()` as a plain multiplier on the min asset price, ignoring composition and weights [E7](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.12.md)
- Price-adjustment helpers chained where an underlying library call already applies the same fee [E4](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-18.md)
- Signed tick-cumulative division that truncates toward zero instead of flooring for negative deltas [E5](https://bugbountylibrary.com/r/c4%3A2024-05-predy%3AM-03.md)[E6](https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AH-05.md)
- Reimplemented Uniswap V3 price math that squares `sqrtPriceX96` without the uint128 overflow guard [E8](https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-05.md)

## How to review
Trace each operand's denomination and each hop's input/output. The invariant: every intermediate value must be in the unit the next step expects, and each hop must consume the previous hop's output token. For aggregation, confirm the math is Σ(priceUSD·priceNative)/n, not (ΣpriceUSD·d)/(ΣpriceNative). For LP tokens, confirm the formula reproduces the real LP market price on a live pool, not just internal consistency. For TWAP ports, compare against Uniswap's OracleLibrary on negative tick deltas. For chained fee helpers, check whether the library call already bakes in the fee. For reimplemented V3 math, diff against `getQuoteAtTick` including its overflow guard. Test with 3+ hop routes where intermediate oracles differ, and pools containing rateProvider tokens.

## Variants seen
- Stale loop variable across multi-hop routes [E1](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-03.md)
- Missing division by rateProvider rate in StablePool BPT pricing [E2](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AH-3.md)
- Sum-before-multiply misdenomination in TWAP consult [E3](https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-34.md)
- Rate-as-multiplier on composable pools, overvaluing LP ~11.7% [E7](https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.12.md)
- Debond fee double-counted across chained helpers [E4](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-18.md)
- Truncation-toward-zero on negative tick deltas [E5](https://bugbountylibrary.com/r/c4%3A2024-05-predy%3AM-03.md)[E6](https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AH-05.md)
- Unchecked sqrtPriceX96 squaring overflow in V3 price math [E8](https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-05.md)

## Impact and severity
Wrong prices feed liquidations, collateral valuation, and deposits. E7 overvalued LP tokens ~11.7%, causing depositor losses; E2 mispriced BPT collateral; E1 and E3 returned wrong oracle values to protocol-sensitive actions; E4 inflated spTKN/base price and overpaid liquidators; E8 corrupted SafEth price accounting. Severity is high because the error is silent and systematic, and worse when the mispriced asset is used as collateral or in liquidation math.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-03.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AH-3.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-34.md
- E4: https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AM-18.md
- E5: https://bugbountylibrary.com/r/c4%3A2024-05-predy%3AM-03.md
- E6: https://bugbountylibrary.com/r/c4%3A2024-03-revert-lend%3AH-05.md
- E7: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.12.md
- E8: https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-05.md