# YAxisVotePower.balanceOf can be manipulated

YAxisVotePower.balanceOf derives voting power from live Uniswap reserves, letting an attacker inflate YAX reserves and boost governance weight.

- Payout: Audit contest
- Severity: medium
- Program: yAxis
- Found by: cmichel
- Disclosed: 2021-11-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-yaxis-findings/issues/113
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-10
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:flash-loan vuln:governance vuln:oracle-manipulation

**Target:** YAxisVotePower governance voting-power contract
**Root cause:** balanceOf computes _lpStakingYax from the spot yaxisEthUniswapV2Pair.getReserves() YAX reserve, which is manipulable within a single transaction/block.
**Steps:**
1. Read `YAxisVotePower.balanceOf`: `(uint256 _yaxReserves,,) = yaxisEthUniswapV2Pair.getReserves();`
2. Compute `_lpStakingYax = _yaxReserves.mul(_stakeAmount).div(_supply).add(rewardsYaxisEth.earned(_voter))`
3. Swap into the YAX/ETH pair to inflate `_yaxReserves` (flashloan or same-block buy)
4. Call balanceOf / trigger vote count while reserves are inflated to gain outsized voting power
5. Unwind position after the count
**How found:** Code review of balanceOf noticed it reads spot Uniswap reserves rather than a time-weighted value, a known manipulation vector.
**Exploitation:** Attacker buys YAX in the Uniswap pair to raise the YAX reserve, then has balanceOf read during vote counting (or frontruns the count block), gaining inflated voting power to pass a governance proposal, then sells back.
**Escalation:** Inflated voting power could pass malicious governance proposals, extracting value from the protocol.
**Insight:** Any governance voting-power function that reads spot AMM reserves is flashloan/same-block manipulable; check whether balanceOf is called by a trusted EOA at a fixed time or can be triggered/frontrun by the attacker.