# VaderPoolV2.mintFungible exposes users to unlimited slippage

VaderPoolV2.mintFungible lacks a minimum-LP-units parameter, letting frontrunners manipulate reserves to shortchange LPs and pocket the difference.

- Payout: Audit contest
- Severity: medium
- Program: Vader Protocol
- Found by: TomFrenchBlockchain
- Disclosed: 2022-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-vader-findings/issues/2
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AM-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** VaderPoolV2.mintFungible liquidity provision function
**Root cause:** mintFungible computes minted liquidity units from current pool reserves but offers no user-specified minimum, so reserve manipulation directly changes the LP's payout.
**Steps:**
1. LP calls `mintFungible` providing tokens in some ratio, no min-units param
2. Attacker frontruns: sells large amount of `nativeAsset` into pool to devalue it
3. LP's mint executes at manipulated reserves, receiving fewer liquidity units
4. Attacker reverses the trade, restoring reserves and pocketing a fraction of LP value
**How found:** Code review of mintFungible noting minted units derive from live reserves with no slippage bound, then reasoning about frontrun sandwich.
**Exploitation:** Frontrunner sandwiches the LP's mintFungible call: dumps nativeAsset to skew reserves before the mint, then sells back after, capturing up to 100% of the LP's provided value.
**Insight:** For any add-liquidity/mint function, check whether minted shares are computed from live reserves without a user-supplied minimum; that gap is a sandwich target even when the ratio is arbitrary.