# Ojo Mellow Price Feed audit Three Sigma · Oracles · 16th October 2024 A private security review of Ojo Network (oracles), conducted with Three Sigma and completed on 16th October 2024 over 2 days. 0xSimao disclosed 2 findings: 1 low and 1 informational. ## What Ojo is Ojo builds oracle infrastructure, including exchange-rate feeds for liquid restaking tokens with a Morpho-compatible interface. The Mellow feed prices LRTs curated by Mellow vaults, and since those vaults hold several asset types the rate leans on the underlying TVL rather than a one-to-one peg. ## Scope A two-day review of the Mellow feed: MellowPriceFeed and the CloneFactory that stamps out instances, with attention on how a multi-currency vault's TVL becomes a single LRT exchange rate. ## Findings ### Low - [Hardcoded 1e18 ratio calculation regardless of decimals](https://0xsimao.com/findings/ojo-network-hardcoded-calculation-regardless-decimals) ### Informational - [The number of underlying tokens may be modified in the Vault leading to inconsistent exchange rate](https://0xsimao.com/findings/ojo-network-number-underlying-modified-inconsistent) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2024-10-16-ojo-network.pdf) [Protocol](https://www.ojo.network/)