# Flash loan manipulation on getPoolShareWeight of Utils

Spartan's getPoolShareWeight derives DAO voting weight from spot pool reserves, so a flash-loan swap inflates an attacker's weight to steal votes and harvest rewards.

- Payout: Audit contest
- Severity: high
- Program: Spartan Protocol
- Found by: shw
- Disclosed: 2021-09-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-07-spartan-findings/issues/238
- Library page: https://bugbountylibrary.com/r/c4%3A2021-07-spartan%3AH-13
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:flash-loan vuln:governance vuln:oracle-manipulation vuln:reward-distribution

**Target:** Utils.getPoolShareWeight / DaoVault depositLP (SPARTAN-WBNB pool)
**Root cause:** getPoolShareWeight computes weight as uints * baseAmount / totalSupply, where baseAmount is the pool's current SPARTAN reserve; spot reserves are manipulable within a single transaction, so weight is not a stable measure of LP value.
**Steps:**
1. Add liquidity to the SPARTAN-WBNB pool to obtain LP tokens (WBNB-SPP).
2. Swap a large amount of WBNB to SPARTAN, splitting the trade into small amounts to reduce slip-based fees, raising the pool's `baseAmount`.
3. Call `deposit` on `Dao` with the LP tokens; `Dao` calls `depositLP` on `DaoVault`, recalculating the attacker's weight against the inflated `baseAmount`.
4. Use the inflated member weight to vote on the current proposal with more votes than deserved, or call `harvest` on `Dao` to obtain excess rewards.
5. Swap SPARTAN back to WBNB, losing only the slip-based fees.
**How found:** Code review of getPoolShareWeight's formula showed weight is proportional to the pool's SPARTAN reserve (baseAmount), a spot value any swap can move within one transaction; traced the deposit→depositLP path to confirm weight is recalculated at deposit time.
**Exploitation:** Attacker needs LP tokens and capital to swap WBNB→SPARTAN (flash-loanable), inflates baseAmount, deposits LP to trigger weight recalculation in DaoVault, exploits inflated weight for governance votes or harvest rewards, then reverses the swap paying only slippage fees.
**Escalation:** Inflated weight applies to both governance voting power and reward distribution via harvest, amplifying payout beyond actual LP share.
**Insight:** Any weight/share/reward formula reading a pool's instantaneous reserve (baseAmount) rather than a time-weighted or stored value is flash-loanable; check every function that recomputes user weight on deposit for spot-price dependence.