# The number of underlying tokens may be modified in the Vault leading to inconsistent exchange rate Low/Info · Three Sigma · Oracles · 16th October 2024 Finding 3S-Ojo-N01 of the Ojo Mellow Price Feed security review. - Protocol: https://www.ojo.network/ - Report: /reports/ojo-mellow-price-feed - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-10-16-ojo-network.pdf --- ### Description The price is calculated based on the ratio from managedRatiosOracle.getTargetRatiosX96(). Currently the vault has only 1 underlying token, which means the ratio will always be 1e18. However, the vault may add more tokens, which would change this. ### Recommendation Clarify the behaviour if more tokens are added. ### Status Addressed in [065a63f](https://github.com/ojo-network/ojo-evm/pull/55/commits/065a63fba089af7caa02f4076b93ead862f6616a). Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [A user with a TapiocaOFT allowance >0 could steal all the underlying ERC20 tokens of the owner](https://0xsimao.com/findings/tapioca-dao-allowance-steal-underlying-erc20): Tapioca DAO - [Malicious user can call `borrowing::calculateCumulativeRate()` any number of times to inflate debt rate as `lastEventTime` is not updated](https://0xsimao.com/findings/autonomint-calculate-times-inflate-debt): Autonomint - [Inconsistent Use of `lastCumulativeRate` in `depositTokens()` and `withdraw()` Functions in `Borrowings` Contract](https://0xsimao.com/findings/autonomint-cumulative-deposit-withdraw-borrowings): Autonomint - [`LenderCommitmentGroup` pools will have incorrect exchange rate when fee-on-transfer tokens are used](https://0xsimao.com/findings/teller-finance-pools-exchange-fee-transfer): Teller Finance