# Incorrect initialization gives IL protection of only 1 second instead of 100 days in Router.sol

Router.sol initialized timeForFullProtection to 1 second instead of 100 days, collapsing Vader's impermanent-loss protection to near-instant full coverage.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Disclosed: 2021-06-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-04-vader-findings/issues/84
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-vader%3AH-09
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:business-logic vuln:misconfiguration

**Target:** Router.sol / Utils.getProtection() IL protection parameter
**Root cause:** timeForFullProtection was initialized to 1 second rather than the 8640000 seconds (100 days) stated in code comments, apparently a test setting carried into deployment; setParams() to reset it is missing DAO functionality.
**Steps:**
1. Read Router.sol L84: `timeForFullProtection = 1;` with comment indicating 100 days intended
2. Note Utils.getProtection() linearly scales protection from 0 to 100% over timeForFullProtection
3. Observe 1 second means depositors reach full IL protection almost immediately
4. Recommend `timeForFullProtection = 8640000; //100 days`
**How found:** Code reading of Router.sol initialization against the documented 100-day IL protection spec; spotted mismatch between comment and literal value.
**Exploitation:** A depositor could deposit and withdraw after ~1 second with full IL protection, draining the reserve to cover any deficit rather than bearing losses over the intended 100-day ramp.
**Insight:** When a protocol's core economic guarantee is a time-ramped parameter, diff the initialized literal against the spec/comments — test values like 1 second silently disable the ramp and let users extract reserve funds.