# BondVault BASE incentive can be gamed

BondVault matches any token deposit with BASE liquidity at spot swap price, letting an attacker manipulate the pool to make the DAO overpay BASE and profit.

- Payout: Audit contest
- Severity: medium
- Program: Spartan Protocol
- Found by: cmichel
- Disclosed: 2021-09-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-07-spartan-findings/issues/178
- Library page: https://bugbountylibrary.com/r/c4%3A2021-07-spartan%3AM-14
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm technique:chained vuln:business-logic vuln:oracle-manipulation

**Target:** BondVault / DAO.bond liquidity matching
**Root cause:** BondVault matches deposited token amounts to BASE using the pool's instantaneous swap value (calcSwapValueInBase) with no TWAP or price sanity check, so a manipulated spot price inflates the BASE the DAO commits.
**Steps:**
1. Drip large amounts of `BASE` into the pool in many small trades to raise the token-per-BASE price (cheap due to path-independent continuous liquidity model).
2. Repeatedly call `DAO.bond(amount)` with small token amounts; `spartaAllocation = _UTILS.calcSwapValueInBase(_token, _amount)` is now high, so the contract sends extra BASE to the pool as liquidity.
3. Reverse step 1 by selling back the tokens; since the DAO added BASE to the reserve, attacker receives more BASE than spent, netting profit.
**How found:** Reading BondVault/DAO.handleTransferIn logic, noticed the matched BASE amount equals the instantaneous swap value of the token trade, making it sandwichable.
**Exploitation:** Attacker sandwiches the DAO's BASE liquidity provisioning: pump spot price, trigger repeated bond() calls so DAO commits BASE at inflated prices, then unwind to capture the DAO-supplied BASE minus trade fees.
**Insight:** When a contract auto-provisions liquidity based on a pool's current swap value, that value is attacker-controllable; check whether the matched amount uses spot vs TWAP and whether repeated small calls amplify the mispricing.