# Attacker can claim more IL by manipulating pool price then removeLiquidity

Attacker manipulates Vader pool price to inflate impermanent-loss reimbursement, then removes liquidity and restores pool to profit risk-free.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: gzeon
- Disclosed: 2022-02-10
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-11-vader-findings/issues/182
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-18
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** VaderRouterV2 removeLiquidity / VaderMath IL calculation
**Root cause:** IL reimbursement uses spot pool reserves (P1) at withdrawal time in VaderMath.sol:L84, so a same-transaction swap can skew the price and inflate the computed loss.
**Steps:**
1. Add 100 FOO + 100 VADER liquidity, own 100% of pair
2. Wait for max IL protection accrual
3. In one tx: swap 9900 FOO -> 99 VADER, leaving pool at 10000 FOO / 1 VADER
4. VaderMath.sol:L84 computes loss = 100*1/10000+100-2 = 98.01 VADER
5. removeLiquidity to receive 10000 FOO + 99.01 VADER
6. Swap back to restore pool balance, netting ~98.01 VADER
**How found:** Code review of the IL reimbursement path in VaderRouterV2.sol:L227 and the spot-price-based loss formula in VaderMath.sol:L84, recognizing that withdrawal-time reserves are attacker-controllable within one tx.
**Exploitation:** Single-transaction atomic sequence: skew reserves via large swap, trigger removeLiquidity so IL is reimbursed against manipulated spot price, then reverse swap to restore reserves; profit bounded by gas, pool fee, pool share and IL protection percentage.
**Insight:** Any reimbursement/insurance payout computed from instantaneous pool reserves is manipulable atomically; check whether the loss formula reads spot reserves at withdrawal rather than a TWAP.