# Paying IL protection for all VaderPool pairs allows the reserve to be drained.

IL protection paid on all VaderPool pairs lets an attacker mint a cheap token, engineer a fake-impermanent-loss LP position, and drain the Vader reserve.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: TomFrenchBlockchain
- Disclosed: 2022-02-10
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-11-vader-findings/issues/34
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-06
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:chained technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** VaderPool/VaderRouter IL protection payout logic
**Root cause:** IL protection is paid for all token pairs and computes loss by comparing initial vs removed asset amounts, assuming the LP entered at true price; an attacker-controlled token with manipulable price breaks that assumption.
**Steps:**
1. Flashloan a large amount of VADER (or flashloan + buy VADER).
2. Deploy token TKN the attacker can mint arbitrarily.
3. Add liquidity to a new VADER/TKN pool with large VADER and small TKN.
4. Use mint ability to buy up all VADER in the pool, engineering a position that looks massively underwater.
5. Repay flashloan with VADER extracted plus pre-existing funds to cover swap fees/slippage.
6. Wait up to a year for IL protection to accrue, then burn LP to claim reserve VADER.
**How found:** Code reading of VaderPool.burn and VaderRouter IL payout: noticed IL protection applies to ALL pairs and that loss is computed from initial-vs-removed amounts, exposing the unspoken assumption that the LP entered at true price.
**Exploitation:** Attacker flashloans VADER, creates a permissionless pool with a self-mintable token, manipulates the pool so the LP position appears deeply underwater due to IL, then redeems the LP after IL protection accrues to extract up to the VADER initially added from the reserve.
**Insight:** When a protocol subsidizes impermanent loss, check whether the subsidy applies to permissionlessly-created pools and whether the loss formula trusts the LP's entry price; a self-mintable paired token lets you fabricate a loss position cheaply.