# Router.getOrCreatePoolAndAddLiquidity can be frontrunned which leads to price manipulation

Attacker frontruns Router.getOrCreatePoolAndAddLiquidity to create the pool at a manipulated active tick, causing the victim's liquidity to be added at a bad price.

- Payout: Audit contest
- Severity: medium
- Program: Maverick
- Found by: rvierdiiev
- Disclosed: 2023-05-03
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-12-stealth-project#m-01
- Library page: http://bugbountylibrary.com/r/c4%3A2022-12-stealth-project%3AM-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window vuln:business-logic

**Target:** Router.getOrCreatePoolAndAddLiquidity / Pool initial active tick
**Root cause:** Pool is initialized with an active tick supplied by the creator, and getOrCreatePoolAndAddLiquidity creates-or-joins atomically, so a frontrunner can pre-create the pool with a different active tick; the victim's addLiquidity then uses that tick when isDelta=true.
**Steps:**
1. Pool for tokenA:tokenB does not exist.
2. Victim calls `Router.getOrCreatePoolAndAddLiquidity(poolParams, tokenId, addParams, minTokenAAmount, minTokenBAmount, deadline)` with an intended active tick and isDelta=true.
3. Attacker frontruns and creates the same pool with a different active tick.
4. Victim's tx executes: getOrCreatePool finds the pool exists, so liquidity is added to the attacker-created pool at the attacker's tick.
5. Attacker swaps the victim's deposited tokens at a favorable price; victim loses part of funds.
**How found:** Code reading of Pool initialization (active tick set at creation) combined with the atomic create-or-join semantics of getOrCreatePoolAndAddLiquidity; recognized the frontrun window on pool creation.
**Exploitation:** Attacker observes the pending create-and-add-liquidity tx, pre-creates the pool with a skewed active tick, then swaps against the victim's mispriced deposit to extract value.
**Insight:** When a router function both creates and seeds a pool in one tx, the creator-supplied initial price/tick is attacker-controllable via frontrun; check whether the deposit path derives pricing from caller params (isDelta) rather than the actual on-chain pool state.