# Trader can manipulate price because bin only moved after swap

Maverick pool moves liquidity bins only after a swap, letting a trader front-run with a null swap to freeze bin position and get a better price.

- Payout: Audit contest
- Severity: medium
- Program: Maverick
- Found by: gzeon
- Disclosed: 2023-05-03
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-12-stealth-project#m-03
- Library page: http://bugbountylibrary.com/r/c4%3A2022-12-stealth-project%3AM-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:business-logic vuln:oracle-manipulation

**Target:** Maverick AMM Pool.sol swap/bin movement logic
**Root cause:** Bins are moved only after the swap completes (after _moveBins call at end of swap), so a trader can submit a zero-amount swap first to update the TWAP and prevent bin movement, then execute the real swap at a stale bin position.
**Steps:**
1. Deploy pool with liquidity bins at pos 0, 2, 10.
2. Trader buys 10 tokens (swap), waits 1 hour (TWAP moves).
3. Trader submits a 0-token swap to update TWAP and trigger bin movement without price impact.
4. Trader then sells 10 tokens at the now-stale bin position, receiving more tokens than without the null swap.
**How found:** Warden noticed _moveBins is called after the swap rather than before, and reasoned that a zero-amount swap could update TWAP and move bins without executing the trade, then tested with two PoC scenarios comparing balances with and without the null swap.
**Exploitation:** Attacker submits a null (0-amount) swap as the first tx of the block to update TWAP and move bins, then submits the genuine swap at a marginally better price. Only profitable when price movement is opposite to prior movement and crosses a bin boundary.
**Insight:** When state (bins/TWAP) is updated after the value-transfer step, a zero-amount or dust swap can be used to advance that state cheaply before the real trade; check ordering of state updates vs. swap execution in AMMs.