# LP pricing formula is vulnerable to flashloan manipulation

LimboDAO burnAsset prices LP tokens from manipulable UniswapV2 pool reserves, letting a flashloan swap inflate fate rewards and governance power.

- Payout: Audit contest
- Severity: high
- Program: Behodler
- Found by: shw
- Disclosed: 2022-03-24
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-01-behodler-findings/issues/304
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-behodler%3AH-07
- Tags: area:web3 domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:flash-loan vuln:governance vuln:oracle-manipulation

**Target:** LimboDAO burnAsset / setEYEBasedAssetStake LP pricing on UniswapV2 LINK-EYE pool
**Root cause:** LP token value is derived from spot pool reserves (x*y=k) rather than a manipulation-resistant fair LP pricing formula, so a large swap skews the computed value.
**Steps:**
1. Pool holds 1000 EYE + 1000 LINK, totalSupply 1000; attacker holds 100 LP.
2. Baseline: burn 100 LP yields `1000 * 100/1000 * 20 = 2000` fate.
3. Attacker swaps 1000 EYE into pool, receives ~500 LINK; pool now 2000 EYE + 500 LINK.
4. Burn 100 LP now yields `2000 * 100/1000 * 20 = 4000` fate.
5. Swap 500 LINK back to recover ~1000 EYE, netting double fate minus swap fees.
**How found:** Code review of burnAsset/setEYEBasedAssetStake pricing logic, recognizing the spot-reserve LP valuation pattern previously exploited in Cheese Bank and Warp Finance.
**Exploitation:** Attacker flashloans/flashswaps EYE, dumps it into the LINK-EYE UniswapV2 pool to inflate reserves, calls burnAsset to mint inflated fate, then reverses the swap to repay the loan; profit via fateToFlan conversion or amplified governance voting power.
**Escalation:** Chaining inflated fate into fateToFlan conversion for direct profit, or using excess fate as voting power to steer system decisions.
**Insight:** Any fate/reward minted from LP token value computed off instantaneous UniswapV2 reserves is flashloan-inflatable; check burn/stake reward paths for spot-reserve pricing and compare against Alpha Finance fair LP pricing.