# Wrong slippage check

ThecosomataETH.addLiquidity derives minAmount from Curve's calc_token_amount, which already reflects pool state, so the slippage check is effectively zero and imbalanced pools drain value.

- Payout: Audit contest
- Severity: medium
- Program: Redacted Cartel
- Found by: cmichel
- Disclosed: 2022-05-11
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-02-redacted-cartel#m-05
- Library page: http://bugbountylibrary.com/r/c4%3A2022-02-redacted-cartel%3AM-05
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** ThecosomataETH.addLiquidity / Curve CryptoPool add_liquidity
**Root cause:** minAmount is computed as expectedAmount minus a percentage, but expectedAmount comes from Curve's calc_token_amount which already returns the pool's current (possibly manipulated/imbalanced) price, so the check is effectively 0% slippage.
**Steps:**
1. Read ThecosomataETH.addLiquidity: `expectedAmount = ICurveCryptoPool(CURVEPOOL).calc_token_amount(amounts)`
2. Observe `minAmount = expectedAmount - ((expectedAmount * slippage) / 1000)`
3. Note calc_token_amount already reflects current pool state per Curve docs, so subtracting a percentage of it does not protect against imbalance
4. In an imbalanced pool (e.g. 99%/1%), calc_token_amount returns a very low value and the code accepts it, losing value
**How found:** Code review of the slippage computation against Curve's documented semantics of calc_token_amount, recognizing that an on-chain same-tx price query makes the slippage check equivalent to zero.
**Exploitation:** No front-run needed: because the price is queried from the pool in the same atomic tx, an imbalanced or manipulated pool yields a low expectedAmount that the code accepts, so the protocol loses value on add_liquidity even via private mempool/Flashbots.
**Insight:** When a contract derives its own slippage floor from an on-chain pool query in the same tx, the check is meaningless; look for minAmount computed from calc_token_amount/spot reserves rather than an externally supplied or oracle price.