# calculate Loss is vulnerable to flashloan attack

VaderPool IL compensation used spot-price LP valuation, letting an attacker flash-buy to skew price, burn LP, and drain reserves via inflated IL payout.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: jonah1005
- Disclosed: 2022-02-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-vader-findings/issues/65
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-10
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:flash-loan vuln:oracle-manipulation

**Target:** VaderPool IL compensation / VaderMath LP valuation
**Root cause:** LP value computed as (A0*P1)+V0 using manipulable spot price P1, mirroring the unsafe Warp Finance formula, so a flashloan price skew inflates the LP value used for IL compensation.
**Steps:**
1. Pool starts with 100 ETH and 100 Vader.
2. Attacker deposits 1 ETH + 1 Vader, owning 1% of liquidity.
3. Wait ~1 year to accrue IL compensation.
4. Flash loan and buy ETH with 99900 Vader, leaving ~0.1 ETH / 100,000 Vader in pool (price ~1 ETH = 1,000,000 Vader).
5. Burn 1% LP at manipulated price.
6. Compute A0*P1+V0 = 1*1,000,000 + 100 vs A1*P1+V1 = 0.001*1,000,000 + 10,000.
7. Claim IL compensation of ~9,891,000, draining reserve.
**How found:** Recognized the LP valuation formula in VaderMath.sol matched Warp Finance's known-unsafe spot-price pricing, then constructed a flashloan price-manipulation scenario to inflate IL compensation.
**Exploitation:** Flash loan large capital to skew pool price, then burn the aged LP position so the inflated (A0*P1)+V0 valuation yields a massive IL compensation payout exceeding real LP value, draining the reserve.
**Insight:** Any IL/insurance payout that values LP using a single-pool spot price is flashloan-manipulable; check whether LP valuation uses fair (Alpha) pricing with external TWAP rather than in-pool reserves.