# Synth realise is vulnerable to flash loan attacks

Synth.realise prices LP tokens off AMM spot ratio, so a flash loan or whale can shift the pool ratio and manipulate Synth LP balance accounting.

- Payout: Audit contest
- Severity: high
- Program: Spartan Protocol
- Found by: jonah1005
- Disclosed: 2021-09-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-07-spartan-findings/issues/40
- Library page: https://bugbountylibrary.com/r/c4%3A2021-07-spartan%3AH-05
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:flash-loan vuln:oracle-manipulation

**Target:** Synth.sol realise() / Utils LP valuation
**Root cause:** realise() computes baseValueLP and baseValueSynth from AMM spot price, which is manipulable within a single transaction; Synth LP is revalued whenever AMM ratio diverges from Synth debt ratio.
**Steps:**
1. Obtain large amount of marked token (flash loan or whale holdings).
2. Transfer marked token to user, then `marked_token.transfer(token_pool.address, flashloan_amount)` to skew pool ratio.
3. Call `token_pool.addForMember(user)` to mint LP, read `received_lp`.
4. Record `token_synth.mapSynth_LPBalance(token_pool.address)` before.
5. Call `token_synth.realise(token_pool.address)` at skewed ratio.
6. Return LP via `token_pool.transfer(token_pool.address, received_lp)` then `removeForMember(user)`.
7. Call `realise` again at restored ratio; observe Synth LP balance drop from 2063.95e18 to 1317.86e18.
**How found:** Noticed realise() derives LP and Synth base values from AMM spot price, which is trivially movable within one tx; recognized the classic spot-price LP valuation flaw.
**Exploitation:** Attacker skews AMM ratio with borrowed/held capital, triggers realise() to revalue Synth LP at the manipulated spot price, then unwinds the pool position and calls realise() again, shifting Synth LP accounting in their favor.
**Insight:** Any function that revalues LP or debt using instantaneous AMM reserves (rather than TWAP/anti-flashloan LP pricing) is a manipulation target; check realise/settle/accounting paths that trigger on ratio divergence.