# VaderPoolV2 incorrectly calculates the amount of IL protection to send to LPs

VaderPoolV2 pays IL protection in VADER using USDV-denominated loss amounts, ignoring the USDV/VADER exchange rate, so LPs receive wrong-sized payouts.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: TomFrenchBlockchain
- Disclosed: 2022-02-10
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-11-vader-findings/issues/54
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-09
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** VaderPoolV2 / VaderReserve IL protection payout
**Root cause:** VaderMath.calculateLoss returns a loss denominated in USDV (the pool's nativeAsset), but VaderReserve pays out that raw number as VADER tokens without converting via the USDV/VADER rate.
**Steps:**
1. Confirm VaderPoolV2 is deployed with USDV as nativeAsset (TwapOracle L281-296, BasePoolV2 L58-59), so all pairs are USDV:TKN.
2. Read VaderPoolV2 IL protection path (L258-268) and VaderReserve payout (L76-90).
3. Read VaderMath.calculateLoss (L73-93): variable names assume VADER units but inputs are USDV amounts.
4. Observe VaderRouterV2 passes calculateLoss output directly to reserve to claim VADER, with no exchange-rate conversion.
5. Conclude an LP with 100 USDV IL receives 100 VADER instead of the USDV-equivalent VADER amount.
**How found:** Code reading: noticed calculateLoss variable names imply VADER units while callers supply USDV amounts, then traced the router passing the result straight to the reserve with no conversion.
**Exploitation:** An LP who suffered IL claims protection; the reserve pays the USDV-denominated loss figure as a raw VADER quantity. Since VADER and USDV rarely trade at parity, the LP over- or under-claims relative to actual IL, draining or underpaying the VADER reserve.
**Insight:** When a protocol has a native accounting asset (USDV) distinct from its payout token (VADER), audit every math helper's unit assumptions against its callers—variable names in math libs often reveal a unit mismatch that survives into payout logic.