# The LP pair underlying price quote could be manipulated

Canto LP token price derived from pool reserves can be inflated by dumping tokens into the pool, enabling over-borrowing against mispriced collateral.

- Payout: Contest reward
- Severity: high
- Program: Canto
- Disclosed: 2022-10-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-NewBlockchain-v2-findings/issues/152
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-canto-v2%3AH-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:flash-loan vuln:oracle-manipulation

**Target:** Stableswap BaseV1-periphery LP pricing (quoteRemoveLiquidity / quote)
**Root cause:** LP token price is computed as amt0*price0 + amt1*price1 using spot reserves and totalSupply, so a large deposit into the pool inflates TVL and thus the quoted LP price within a single block.
**Steps:**
1. Read BaseV1-periphery.sol L522-526: price = amt0*price0 + amt1*price1 where amt0/amt1 come from quoteRemoveLiquidity.
2. quoteRemoveLiquidity computes amountA = liquidity*reserveA/totalSupply using current reserves.
3. Attacker dumps a large amount of token0/token1 into the pair, inflating reserveA/reserveB.
4. Recompute LP price: inflated TVL yields a higher LP token price.
5. Use inflated LP as collateral in the lending market to borrow beyond fair value.
**How found:** Warden reviewed the LP pricing math in BaseV1-periphery and recognized the spot-reserve-based TVL formula is manipulable, citing the prior Warp Finance exploit as precedent.
**Exploitation:** Attacker flash-dumps tokens into the LP pool to spike reserves, causing the LP price quote to rise, then uses the overvalued LP as collateral to borrow and drain the lending market, all within one block (no price risk).
**Insight:** Any LP-collateral pricing that reads spot reserves/totalSupply (rather than fair reserves or a manipulation-resistant oracle) is inflatable in one block; check lending markets that accept LP tokens as collateral for this exact formula.