# Price deviation as is can be circumvented by making smaller trades in a loop Medium · Three Sigma · NFT perpetuals · 29th January, 2024 Finding 3S-NFTPerp-M03 of the Nftperp Matching Engine security review. - Report: /reports/nftperp-ii - Source: https://cdn.sanity.io/files/qoqld077/production/87f617e82d5468500e950a669f30607376b37c32.pdf --- ### Description The price deviation [check](https://github.com/nftperp/NFTPerp-V2-Contracts/blob/8ea05fc0ecf299ca8374b571486846652c8725f8/src/AMMRouterBase.sol#L290) will look at the last price snapshots; however, it does not actually enforce that these are from past blocks. Thus, attackers may split a trade in smaller trades and incrementally increase the price. ### Recommendation Store the price of the previous block. ### Status Addressed in [#089ec00](https://github.com/nftperp/NFTPerp-V2-Contracts/commit/089ec0050504d11f4141f0834afa675f0e753326) --- Related findings: - [_getPriceToTick() reverts if the price is smaller than 1e10, which may happen in _search() as it assumes the final tick as going entirely to the amm](https://0xsimao.com/findings/nftperp-i-price-reverts-happen-entirely): Nftperp Exchange