# LPs of VaderPoolV2 can manipulate pool reserves to extract funds from the reserve.

VaderPoolV2 LPs flashloan to skew pool reserves, inflate impermanent-loss payout from reserve, then rebalance for profit.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: TomFrenchBlockchain
- Disclosed: 2022-02-10
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2021-11-vader-findings/issues/31
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-05
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** VaderPoolV2 / VaderRouterV2 AMM pool and IL-protection reserve
**Root cause:** Impermanent-loss compensation in VaderPoolV2.burn is computed from current spot pool reserves, which an LP can manipulate within a single transaction.
**Steps:**
1. Become an LP and hold position long enough that IL protection scales toward 100% (up to a year).
2. Flashloan a large amount of one pool asset.
3. Swap against the pool to unbalance reserves so the LP position shows huge impermanent loss.
4. Call burn/removeLiquidity to withdraw and receive VADER compensation from the reserve for the engineered IL.
5. Re-add liquidity to the pool.
6. Swap back to rebalance the pool and repay the flashloan.
**How found:** Code review of VaderPoolV2.burn and VaderMath IL calculation, noticing the loss is derived from live pool reserves rather than a manipulation-resistant price source.
**Exploitation:** Attacker flashloans one pool asset, trades to skew reserves, triggers burn to claim inflated IL payout in VADER from the reserve, re-adds liquidity, and reverses the trade. Profit = reserve payout minus swap fees/slippage; LP position value unchanged.
**Escalation:** Scales with LP position size; after a year any large LP is incentivized to drain the reserve.
**Insight:** When a payout formula reads spot reserves, check whether a single actor can move those reserves and claim the payout in the same transaction; IL/rebate mechanisms are prime targets for flashloan-funded reserve skewing.