```\n    for (uint256 i = 0; i < tokenList.length; i++) {\n        address _token = tokenList[i];\n        (address assetDToken,,,,,,,,,,) = d3Vault.getAssetInfo(_token);\n        uint256 tokenBalance = IERC20(assetDToken).balanceOf(user);\n        if (tokenBalance > 0) {\n            tokenBalance = tokenBalance.mul(d3Vault.getExchangeRate(token)); <- @audit-issue queries token instead of _token\n            (uint256 tokenPrice, uint8 priceDecimal) = ID3Oracle(d3Vault._ORACLE_()).getOriginalPrice(_token);\n            usedQuota = usedQuota + tokenBalance * tokenPrice / 10 ** (priceDecimal+tokenDecimals);\n        }\n    }\n```\n