# Yield of LiquidityReserve can be stolen

LiquidityReserve distributes instant-unstake fees immediately, letting an attacker JIT-add liquidity before a large unstake and remove it after to steal the fee yield.

- Payout: Contest reward
- Severity: high
- Program: Yieldy
- Credited: Picodes
- Disclosed: 2022-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-yieldy-findings/issues/164
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-yieldy%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan

**Target:** LiquidityReserve / Staking instantUnstakeReserve
**Root cause:** Fees from instantUnstakeReserve are distributed instantly to current LPs, and liquidity can be added/removed in the same block with no penalty or lock, so share value jumps for anyone present at fee time.
**Steps:**
1. Observe pending `instantUnstakeReserve()` call producing fee `x`.
2. Tx1: borrow large amount of `stakingToken`, call `addLiquidity` to mint shares.
3. Tx2: user's `instantUnstakeReserve()` executes, fee `x` raises `totalLockedValue` and share value.
4. Tx3: `removeLiquidity`, capture large proportion of fee, repay loan.
**How found:** Reading instantUnstakeReserve fee distribution and noting addLiquidity/removeLiquidity have no lock or penalty, making JIT risk-free and profitable.
**Exploitation:** Attacker flash-borrows stakingToken, adds liquidity just before the victim's instant unstake, then removes liquidity right after, capturing most of the fee that should accrue to genuine LPs who had capital locked.
**Insight:** When yield/fees are credited to share price instantly, check whether liquidity can enter and exit within the same block; JIT sandwiching is profitable if there is no lockup or withdrawal fee.