# Covering impermanent loss allows profiting off asymmetric liquidity provision at expense of reserve holdings

Vader's IL reimbursement uses pre-slip-adjustment deposit values, letting attackers skew pools asymmetrically and drain reserves via IL coverage.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: hyh
- Disclosed: 2022-02-10
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-11-vader-findings/issues/255
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-32
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** VaderRouterV2 / BasePoolV2 / VaderPoolV2 AMM liquidity and IL math
**Root cause:** IL is computed from original deposit asset values without accounting for slip adjustment applied at mint, so skewed asymmetric deposits inflate IL and get reimbursed from reserves.
**Steps:**
1. Call `VaderRouterV2.addLiquidity` (L114) to mint an asymmetric LP position via `BasePoolV2.mint` (L168) with NFT.
2. Either swap against the now-skewed pool for immediate profit, or pre-place a symmetric deposit and exit it now.
3. Wait for IL protection to be enabled.
4. Call `VaderRouterV2.removeLiquidity` (L227) / `VaderPoolV2.burn` (L237); IL computed in `VaderMath.sol#L73` ignores slip adjustment, so reserve fund covers the inflated IL.
**How found:** Code review of IL math in VaderMath.sol#L73 noticing original deposit values are used without slip adjustment, combined with reasoning about asymmetric mint share issuance.
**Exploitation:** Attacker locks liquidity asymmetrically (more Vader than market price), skewing the pool; slip adjustment reduces deposit 2's share issuance while a prior symmetric deposit 1 gains asset claims. Attacker exits deposit 1 at profit, then withdraws deposit 2 after IL protection kicks in, having the inflated IL reimbursed from reserves.
**Escalation:** Two-step deposit variant: deposit 1 at 0 slip matching market, deposit 2 skewed to inflate IL, exit deposit 1 immediately for profit, exit deposit 2 later with IL covered by reserves.
**Insight:** When a protocol reimburses impermanent loss, check whether the IL formula uses pre-fee/pre-slippage nominal deposit amounts rather than actual credited shares — any mismatch lets an attacker manufacture 'loss' via skewed deposits and claim it from reserves.