# Potential overflow in PancakeSwapPlugin:getRoutePrice() Medium · Three Sigma · DeFi infrastructure · 10th November, 2023 Finding 3S-Clip Finance-M01 of the Clip Finance Strategies security review. - Protocol: https://www.clip.finance/ - Report: /reports/clip-finance-i - Source: https://cdn.sanity.io/files/qoqld077/production/c23d04c8223879d2443221caf3ccb55ac118441a.pdf --- ### Description Currently the price is [calculated](https://github.com/ClipFinance/StrategyRouter-private/blob/Audit-fixes/contracts/exchange/PancakeSwapPlugin.sol#L284) as uint256 routePrice = FullMath.mulDiv(uint256(sqrtPriceX96) * uint256(sqrtPriceX96), precision0, 2 ** (96 * 2));. Doing uint256(sqrtPriceX96) * uint256(sqrtPriceX96) might overflow as 2 uint160 variables may result in a number with more than 256 bits. The correct way of calculating this is in OracleLibrary:getQuoteAtTick(), [here](https://github.com/pancakeswap/pancake-v3-contracts/blob/main/projects/v3-periphery/contracts/libraries/OracleLibrary.sol#L49). Note: also [here](https://github.com/ClipFinance/StrategyRouter-private/blob/Audit-fixes/contracts/liquidityManagment/PHyperLPool.sol#L281). ### Status Addressed in [#3d2ad8c](https://github.com/ClipFinance/StrategyRouter-private/commit/3d2ad8c1de5a241104c5eb805ab3ac4b97c91cb8) --- Related findings: - [Performing a direct multiplication in `_getPriceFromSqrtX96` will overflow for some uniswap pools](https://0xsimao.com/findings/teller-finance-performing-price-overflow-uniswap): Teller Finance