# Liquidity token value can be manipulated

Notional LP token value derived from manipulable current market reserves, letting flash-loan traders shift LP collateral value and trigger unfair liquidations or undercollateralized borrows.

- Payout: Audit contest
- Severity: high
- Program: Notional
- Found by: cmichel
- Disclosed: 2021-10-01
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2021-08-notional-findings/issues/85
- Library page: https://bugbountylibrary.com/r/c4%3A2021-08-notional%3AH-10
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:flash-loan vuln:liquidation vuln:oracle-manipulation

**Target:** AssetHandler.getLiquidityTokenValue / LP token collateral valuation
**Root cause:** LP token value sums cash and fCash claims computed as `market.totalAssetCash.mul(token.notional).div(market.totalLiquidity)` and `market.totalfCash.mul(token.notional).div(market.totalLiquidity)`, so it depends on current manipulable market reserves despite TWAP-priced fCash.
**Steps:**
1. Identify `AssetHandler.getLiquidityTokenValue` summing cash and fCash claims.
2. Note claims use `market.totalAssetCash`/`market.totalfCash` divided by `market.totalLiquidity` — current reserves.
3. Flash-loan a large amount and trade into the market to shift cash/fCash reserves within one tx.
4. Observe LP token value (and post-haircut collateral value) change; liquidate users or borrow against inflated value.
5. Restore reserves, paying fees/slippage, and net profit if AMM allows.
**How found:** Code review of LP valuation: noticed the claim formula divides by current `market.totalLiquidity`/reserves, effectively incorporating spot reserves into an otherwise TWAP-based valuation — the classic 'using spot price as oracle' footgun.
**Exploitation:** Attacker flash-loans capital, executes a large lend/borrow order to skew pool reserves and the LP token's cash/fCash claims, altering its collateral value after haircuts; can liquidate near-threshold borrowers or borrow against inflated collateral, then unwind. Profitability depends on AMM fees/slippage.
**Escalation:** Chained with free-collateral haircut logic: fCash claims double-haircut vs cash claims single-haircut, so an attack that raises raw LP value can still lower post-haircut collateral value, enabling liquidation of accounts near minimum collateralization.
**Insight:** When valuing LP tokens, check whether claim amounts are computed from current pool reserves even if the underlying asset price is TWAP'd; reserve-dependent claim ratios reintroduce spot manipulation, and asymmetric haircuts on the two claim legs can flip value direction.