MEDIUM severity: The vulnerability in the BunniToken price calculation process lies in the inconsistency between the . The vulnerability in the BunniToken price calculation process lies in the inconsistency between the deviation check and the final price computation. The deviation check, performed in the `_validateReserves` function, considers both position reserves and uncollected fees when validating the deviation...

Vulnerable code:
```\n### BunniPrice.sol and BunniSupply.sol:\n\n    function _validateReserves(\n        BunniKey memory key_,\n        BunniLens lens_,\n        uint16 twapMaxDeviationBps_,\n        uint32 twapObservationWindow_\n    ) internal view {\n        uint256 reservesTokenRatio = BunniHelper.getReservesRatio(key_, lens_);\n        uint256 twapTokenRatio = UniswapV3OracleHelper.getTWAPRatio(\n            address(key_.pool),\n            twapObservationWindow_\n        );\n\n        if (\n            Deviation.isDeviatingWithBpsCheck(\n                reservesTokenRatio,\n                twapTokenRatio,\n                twapMaxDeviationBps_,\n                TWAP_MAX_DEVIATION_BASE\n            )\n        ) {\n            revert BunniPrice_PriceMismatch(\n                address(key_.pool),\n                twapTokenRatio,\n                reservesTokenRatio\n            );\n        }\n    }\n\n### BunniHelper.sol:\n\n    function getReservesRatio(BunniKey memory key_, BunniLens lens_) public view returns (uint256) {\n        IUniswapV3Pool pool = key_.pool;\n        uint8 token0Decimals = ERC20(pool.token0()).decimals();\n\n        (uint112 reserve0, uint112 reserve1) = lens_.getReserves(key_);\n        \n        (uint256 fee0, uint256 fee1) = lens_.getUncollectedFees(key_);\n        \n        return (reserve1 + fee1).mulDiv(10 ** token0Decimals, reserve0 + fee0);\n    }\n\n### UniswapV3OracleHelper.sol:\n\n    function getTWAPRatio(\n        address pool_,\n        uint32 period_\n    ) public view returns (uint256) {\n        int56 timeWeightedTick = getTimeWeightedTick(pool_, period_);\n        IUniswapV3Pool pool = IUniswapV3Pool(pool_);\n        ERC20 token0 = ERC20(pool.token0());\n        ERC20 token1 = ERC20(pool.token1());\n\n        uint256 baseInQuote = OracleLibrary.getQuoteAtTick(\n            int24(timeWeightedTick),\n            uint128(10 ** token0.decimals()), // 1 unit of token0 => baseAmount\n            address(token0),\n            address(token1)\n        );\n        return baseInQuote;\n    }\n```\n```\nfunction _getTotalValue(\n    BunniToken token_,\n    BunniLens lens_,\n    uint8 outputDecimals_\n) internal view returns (uint256) {\n    (address token0, uint256 reserve0, address token1, uint256 reserve1) = _getBunniReserves(\n        token_,\n        lens_,\n        outputDecimals_\n    );\n\n    uint256 outputScale = 10 ** outputDecimals_;\n\n    uint256 totalValue;\n    totalValue += _PRICE().getPrice(token0).mulDiv(reserve0, outputScale);\n    totalValue += _PRICE().getPrice(token1).mulDiv(reserve1, outputScale);\n\n    return totalValue;\n}\n```\n```\nfunction getProtocolOwnedLiquidityReserves()\n    external\n    view\n    override\n    returns (SPPLYv1.Reserves[] memory)\n{\n    uint256 len = bunniTokens.length;\n    SPPLYv1.Reserves[] memory reserves = new SPPLYv1.Reserves[](len);\n\n    for (uint256 i = 0; i < len; i++) {\n        TokenData storage tokenData = bunniTokens[i];\n        BunniToken token = tokenData.token;\n        BunniLens lens = tokenData.lens;\n        BunniKey memory key = _getBunniKey(token);\n\n        (\n            address token0,\n            address token1,\n            uint256 reserve0,\n            uint256 reserve1\n        ) = _getReservesWithFees(key, lens);\n\n        _validateReserves(\n            key,\n            lens,\n            tokenData.twapMaxDeviationBps,\n            tokenData.twapObservationWindow\n        );\n\n        address[] memory underlyingTokens = new address[](2);\n        underlyingTokens[0] = token0;\n        underlyingTokens[1] = token1;\n        uint256[] memory underlyingReserves = new uint256[](2);\n        underlyingReserves[0] = reserve0;\n        underlyingReserves[1] = reserve1;\n\n        reserves[i] = SPPLYv1.Reserves({\n            source: address(token),\n            tokens: underlyingTokens,\n            balances: underlyingReserves\n        });\n    }\n\n    return reserves;\n}\n```