# Medium: Consider alternative price feed + ensure _minLockPeriod > 0 to prevent flash loan attacks

Zero minLockPeriod plus spot-price-based vault share valuation lets a flash loan inflate/deflate MIM-UST pool price to mint excess shares and drain yield.

- Payout: Audit contest
- Severity: medium
- Program: Sandclock
- Found by: hickuphh3
- Disclosed: 2022-02-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-sandclock-findings/issues/150
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-sandclock%3AM-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:flash-loan vuln:oracle-manipulation vuln:share-inflation

**Target:** Vault contract with nonUST strategy using Curve pool spot price
**Root cause:** Vault allows _minLockPeriod == 0 (immutable, unchangeable) and the nonUST strategy values assets via manipulable Curve pool spot price (get_dy_underlying), so share minting can be gamed within a single transaction.
**Steps:**
1. Flash loan MIM from Uniswap V3 MIM-USDC pool (~$3.5M available).
2. Swap half the MIM to UST to inflate UST / deflate MIM spot price in the MIM-UST Curve pool.
3. Deposit remaining MIM into vault; `curvePool.get_dy_underlying(ustI, underlyingI, ustAssets)` returns a smaller value, so attacker receives more shares than deserved.
4. Swap UST back to MIM to restore pool spot price.
5. Withdraw from vault; fewer shares deducted due to restored price, profit booked as yield.
6. Claim yield and repay flash loan.
**How found:** Code review noting _minLockPeriod is immutable and unguarded against zero, combined with recognizing the nonUST strategy relies on manipulable Curve spot price for asset valuation.
**Exploitation:** Single-transaction flash loan: borrow MIM, skew Curve MIM-UST spot price, deposit at depressed valuation to mint inflated shares, restore price, withdraw/claim yield, repay loan.
**Insight:** When a vault mints shares from a strategy's asset valuation, check whether that valuation reads an AMM spot price (get_dy_underlying) and whether any lock/delay parameter can be zero, enabling same-block manipulation.