# Oracle price conversion and margin errors

Missing pair bridges, false 1:1 share rates, and double-counted oracle error margins in price math

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2025-06-27. Updated 2026-10-30._

## How it works
Price math rests on an assumption about how one value converts to another: that a wrapped or share token redeems 1:1 for its underlying, that a configured trading pair exists, or that an error margin is applied once. When that assumption is false, the computed price diverges from real value. The protocol then lends, converts, or liquidates at the wrong number, and whoever can exploit the gap profits.

## Where it shows up
- Reward converters or routers with a hardcoded/default bridge path that may not exist on-chain [E1](https://bugbountylibrary.com/r/dhl%3A20210125-sushi-badger-digg.md)
- Oracle code multiplying a share-token rate by an underlying price, assuming 1:1 [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-8.md)
- Share contracts whose redeem/withdraw path includes swaps, fees, or slippage [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-8.md)
- Price formulas multiplying two factors that each already embed an oracle error margin [E3](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-03.md)
- Parent-child asset pricing (e.g. RToken over BU over collateral) where margins compound [E3](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-03.md)

## How to review
- For any conversion, read the actual redeem/withdraw implementation and confirm the rate is truly 1:1, or that fees/slippage are subtracted.
- For any configured pair or bridge, verify the pair exists and has real liquidity; if it can be created cheaply, treat conversion as sandwichable [E1](https://bugbountylibrary.com/r/dhl%3A20210125-sushi-badger-digg.md).
- For composed prices, trace each factor and check whether it already includes an error/slippage margin; the invariant is that uncertainty is applied exactly once, not multiplied [E3](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-03.md).
- Confirm the oracle price cannot be inflated relative to realizable redemption value, since overvaluation enables over-borrowing [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-8.md).

## Variants seen
- Missing bridge/pair lets tokens accumulate, then attacker seeds a shallow pair and sandwiches the conversion [E1](https://bugbountylibrary.com/r/dhl%3A20210125-sushi-badger-digg.md)
- False 1:1 SY-to-yield-token assumption inflates PT price when redemption incurs fees [E2](https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-8.md)
- Oracle error margin double-counted across BU price and basket range, widening the estimate [E3](https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-03.md)

## Impact and severity
E1 drained 81 ETH via sandwich on accumulated rewards. E2 let users over-borrow against overvalued collateral, risking bad debt. E3 widened price estimates, weakening liquidation and valuation accuracy. Severity rises when the mispriced value feeds borrowing or liquidation, since the error becomes directly monetizable.

## Why fixes fail
No fix evidence in these reports.

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20210125-sushi-badger-digg.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2025-06-notional-exponent%3AH-8.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-03.md