# LPs of VaderPoolV2 can manipulate pool reserves to extract funds from the reserve.

VaderPoolV2 LPs flashloan to unbalance pool reserves, inflating impermanent-loss payout from the reserve, then rebalance for profit.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: TomFrenchBlockchain
- Disclosed: 2022-05-03
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2021-12-vader-findings/issues/55
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-06
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** VaderPoolV2 AMM pool / VaderRouterV2 burn IL compensation
**Root cause:** Impermanent-loss compensation in burn is computed from current spot pool reserves, which an LP can manipulate within a single transaction, so engineered IL is refunded from the reserve.
**Steps:**
1. Be an LP for a long period so IL protection scales toward 100% after a year
2. Flashloan a large amount of one pool asset
3. Swap against the pool to unbalance reserves so your LP position shows huge IL
4. Call `VaderPoolV2.burn` / router to remove liquidity and receive VADER IL compensation from reserve
5. Re-add liquidity
6. Swap back to rebalance the pool
**How found:** Code review of burn's IL calculation in VaderMath.sol noticing it reads current pool reserves (spot price) rather than a manipulation-resistant oracle, making the payout attacker-controllable.
**Exploitation:** Attacker flashloans one pool asset, dumps it into the pool to skew reserves and inflate computed IL on their existing LP position, withdraws liquidity to claim reserve-funded VADER compensation, then re-adds liquidity and reverses the swap to restore balance; profit = compensation minus swap fees/slippage, repaid flashloan.
**Escalation:** Scales with LP position size and time held (IL protection linear to 100% after a year); large LP can drain reserve.
**Insight:** When a protocol pays out based on 'loss' computed from live pool reserves, check whether an LP can move those reserves in the same tx as the claim; spot-price-derived compensation is flashloan-manipulable.