# Critical Raydium Vulnerability Fixed: Whitehat Saves Liquidity Pools

Raydium CLMM increase_liquidity failed to validate remaining_accounts[0] as the pool's TickArrayBitmapExtension, letting an attacker flip tick bitmap bits and inflate liquidity to drain pools.

- Payout: $505,000
- Severity: critical
- Program: Raydium
- Credited: riproprip
- Disclosed: 2024-09-02
- Write-up quality: 8/10
- Original: https://immunefi.com/blog/bug-fix-reviews/raydium-tick-manipulation-bugfix-review/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-raydium-tick-manipulation-bugfix-review
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:rust tech:solana technique:chained technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic

**Target:** Raydium CLMM increase_liquidity instruction (Solana/Anchor)
**Root cause:** increase_liquidity passed remaining_accounts[0] as the TickArrayBitmapExtension without verifying it matches the pool, so an attacker-supplied bitmap account could be used to flip tick status bits.
**Steps:**
1. Identify victim CLMM pool with price points A<B<C in lower bitmap range.
2. Swap price to just above A (A+1).
3. Open liquidity position in range B..C.
4. Swap across B without crossing C, adding liquidity to pool state via manipulated tickarray_bitmap.
5. Call increase_liquidity with attacker-controlled remaining_accounts[0] to flip tick B status to DISABLED.
6. Swap at A+1 skipping over B without affecting liquidity.
7. Repeat to re-enable B, swap over B again, doubling liquidity erroneously.
8. Repeat to amass inflated liquidity, then swap toward C to extract disproportionate Token A (mirror at high end for Token B).
**How found:** Whitehat noticed increase_liquidity conditionally used remaining_accounts[0] for the bitmap extension without validating it against pool_state, and reasoned a forged account could flip tick bits.
**Exploitation:** Attacker creates a secondary pool and position, then repeatedly calls increase_liquidity supplying a forged TickArrayBitmapExtension in remaining_accounts[0] to toggle tick bitmap bits, inflating their position's liquidity; swaps then pay out far more tokens than deposited, draining the pool.
**Escalation:** Repeating the flip/re-enable cycle multiplies liquidity arbitrarily, amplifying extraction.
**Insight:** In Anchor programs, any remaining_accounts entry used for state-dependent logic must be key-checked against the owning pool (require_keys_eq with derived PDA); audit every remaining_accounts[0] usage for missing PDA validation.