# Attacker can get extremely cheap synth by front-running create Pool

Permissionless createPool lets attacker set an absurdly cheap initial price for a new token, then mint large amounts of synth and drain LPs.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: jonah1005
- Disclosed: 2022-02-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-vader-findings/issues/98
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-12
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** VaderPoolFactory.createPool / VaderPoolV2 synth minting
**Root cause:** createPool is permissionless and the first LP sets the token price with no minimum liquidity or supported-asset check, so an attacker controls the initial price and can mint synth against it.
**Steps:**
1. Call `createPool` for a new popular `coin` before the DAO/legit LPs.
2. Deposit `1 wei coin` + `10^18 wei Vader` to set an extremely cheap coin price.
3. Provide another `10^18 wei Vader` to mint a large amount of synth at the manipulated price.
4. Pool cannot be revoked; attacker drains LP value from the pool.
**How found:** Reading VaderPoolFactory.createPool and VaderPoolV2 mint logic, noticed createPool is permissionless and first-LP pricing with no minimum liquidity or asset allowlist.
**Exploitation:** Attacker front-runs pool creation for a token the DAO intends to add, seeds it at a near-zero price, mints synth cheaply, and drains LP since the pool cannot be revoked.
**Insight:** On AMM-style protocols, check whether pool creation and initial pricing are permissionless and whether synth/mint functions can be called against a freshly seeded, attacker-priced pool before liquidity or allowlist gates apply.