# Potentially depositing at unfavorable rate since anyone can deposit the entire lenderPool to a known strategy at a pre-fixed time

Anyone could call start() at a pre-announced time, depositing the whole lenderPool into a strategy pool they had pre-manipulated to an unfavorable rate.

- Payout: Audit contest
- Severity: medium
- Program: Sublime
- Found by: kyliek
- Disclosed: 2022-07-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-sublime-findings/issues/64
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-sublime%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:oracle-manipulation

**Target:** LenderPool.start() depositing into external yield strategy (Compound/Curve)
**Root cause:** start() is permissionless and deposits the entire pool into a known strategy at a predictable time, so an attacker can pre-manipulate the strategy pool's exchange rate/imbalance before the deposit.
**Steps:**
1. Monitor each LenderPool's totalSupply vs minBorrowAmount and note borrowAsset, strategy target pool, and announced startTime.
2. Before startTime, deposit a large sum into the strategy pool to skew its exchange rate (Compound) or imbalance it (Curve).
3. Call `start(_to=attacker)` first at startTime so the whole pool deposits at the unfavorable rate and attacker pockets the protocol fee.
4. Withdraw priming liquidity and harvest arbitrage/rebalancing profit, or grief the pool.
**How found:** Warden noted start() is callable by anyone at a pre-announced time and deposits the full pool into a known strategy; reasoned that a predictable large deposit into a manipulable pool enables sandwiching, citing the Yearn 2021-02-04 disclosure as precedent.
**Exploitation:** Attacker primes the external strategy pool with capital (optionally via flashbots to limit exposure), triggers start() to deposit the entire lenderPool at the skewed rate, then unwinds the priming position and captures the arbitrage/rebalancing gain.
**Insight:** When a contract pushes a large, predictable deposit into an external yield/AMM pool at a publicly known time, treat the deposit itself as a sandwichable swap: check whether the target pool's rate moves on deposit and whether priming it beforehand yields extractable value.