# Manipulation of the Y State Results in Interest Rate Manipulation

Unconstrained mint inputs let an attacker pay 3 wei to inflate Timeswap pool interest rate from ~1-15% to ~40-646%, destroying the pool.

- Payout: Audit contest
- Severity: high
- Program: Timeswap
- Found by: Rhynorater
- Disclosed: 2022-03-03
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-01-timeswap-findings/issues/187
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-timeswap%3AH-03
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** TimeswapPair.sol mint function (AMM lending pool)
**Root cause:** TimeswapPair.mint lacks bounds/validation on xIncrease, yIncrease, zIncrease, so an attacker can supply a tiny xIncrease with a huge yIncrease, directly skewing the y state that determines the interest rate curve.
**Steps:**
1. LP initializes pool via mint with xIncrease=5000e18, yIncrease=(APR*x)/SEC_PER_YEAR/100, zIncrease=5x/3, yielding ~1-15% rate.
2. Attacker calls pair.mint(maturity, liquidityTo, dueTo, xIncrease=3, yIncrease=1000000000000000, zIncrease=5, "").
3. Callback transfers only 3 wei asset and 6 wei collateral to the pair.
4. Pair's y state jumps from 23766573461559 to 1023766573461559, shifting min/max interest rate to ~40-646%.
5. Resulting rate curve destroys the pool economics for LPs and borrowers.
**How found:** Author read TimeswapPair.mint and noticed no constraints on user-supplied x/y/z increases; hypothesized that yIncrease directly drives the interest rate curve, then wrote a HardHat PoC comparing constantProduct before/after a malicious mint to confirm the rate shift.
**Exploitation:** Attacker deploys a contract implementing ITimeswapMintCallback, calls mint with near-zero xIncrease/zIncrease but a large yIncrease, pays 3 wei asset + 6 wei collateral in the callback, and permanently skews the pool's interest rate to 40-646%, griefing LPs and other pool participants.
**Insight:** In AMM-style lending pools, the state variable that feeds the interest-rate formula (here y) is often settable via mint/liquidity params; check whether mint lets you move that state disproportionately to the tokens actually paid, and compute the rate curve delta rather than just the token delta.