# Stop ramp target price would create huge arbitrage space.

stopRampTargetPrice instantly rewrites tokenPrecisionMultipliers, shifting AMM virtual price; attacker sandwiches the DAO-triggered call to arbitrage the pool.

- Payout: Audit contest
- Severity: medium
- Program: Boot Finance
- Found by: jonah1005
- Disclosed: 2022-01-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-bootfinance-findings/issues/208
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-bootfinance%3AM-05
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:governance vuln:oracle-manipulation

**Target:** customswap AMM Swap.sol stopRampTargetPrice / tokenPrecisionMultipliers
**Root cause:** stopRampTargetPrice sets tokenPrecisionMultipliers to originalPrecisionMultipliers[0]*currentTargetPrice/WEI_UNIT in a single step, instantly repricing the pool instead of ramping the multiplier gradually.
**Steps:**
1. Observe DAO proposal to call stopRampTargetPrice has passed.
2. Front-run the stopRampTargetPrice tx with a swap that profits from the pre-change price.
3. stopRampTargetPrice executes, setting tokenPrecisionMultipliers[0] = originalPrecisionMultipliers[0]*currentTargetPrice/WEI_UNIT.
4. Back-run with reverse swap to capture the price delta; PoC mock setPrecisionMultiplier(2) moves getVirtualPrice from 1e18 to ~1.4999e18.
**How found:** Code review of stopRampTargetPrice noticed it mutates tokenPrecisionMultipliers directly; reasoned that any instant multiplier change reprices the AMM and is sandwichable, then built a mockSwap with setPrecisionMultiplier to confirm virtual price shift.
**Exploitation:** Attacker bot watches DAO governance; once the stopRampTargetPrice proposal passes, it sandwiches the execution tx: trade before the multiplier change and reverse after, capturing the virtual-price jump (~50% in PoC) as profit at LPs' expense.
**Insight:** Any admin/governance function that instantly changes a pool's precision multiplier or virtual-price parameter is a sandwich target; check whether such setters ramp gradually like aPrecise or apply atomically.