# Attacker can manipulate low TVL Uniswap V3 pool to borrow and swap to make Lending Pool in loss

ParaSpace valued Uniswap V3 LP collateral via spot price of attacker-created low-TVL pool, letting a flash-loan swap inflate LP value and over-borrow.

- Payout: Contest reward
- Severity: high
- Program: ParaSpace
- Credited: minhquanym
- Disclosed: 2023-04-27
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-11-paraspace-findings/issues/407
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-paraspace%3AH-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:flash-loan vuln:oracle-manipulation

**Target:** UniswapV3OracleWrapper.getTokenPrice LP-collateral oracle
**Root cause:** LP position value is computed from the spot sqrtPriceX96 of whichever Uniswap V3 pool the position belongs to, with no TVL/whitelist check, so a pool the attacker controls sets the price.
**Steps:**
1. Create a new WETH/DAI Uniswap V3 pool with full-range liquidity only from attacker: `1e18 wei WETH - 1e6 wei DAI`.
2. Deposit the LP position into ParaSpace; oracle values it ~1 WETH; borrow max USDC.
3. Swap in the attacker's own pool to shift price so the position becomes `1e-12 WETH - 1 DAI` (~1 DAI).
4. Alternatively: flash loan, swap price to p2, add liquidity and borrow at p2, swap back to p1, repay flash loan in one tx.
**How found:** Code review of getTokenPrice noticed the @audit comment that value derives from pool spot price; realized UniV3 allows many pools per pair with different fees, so an attacker can create a near-zero-TVL pool and control its price.
**Exploitation:** Attacker seeds a low-TVL UniV3 pool they fully own, deposits the LP as collateral, and uses a flash-loan swap to move the pool's spot price so the oracle overvalues the LP (e.g. $3mm from 100 USDC/100 USDT), then borrows against the inflated value and drains the lending pool.
**Escalation:** Single-transaction flash-loan sequence (swap to p2, borrow, swap back to p1, repay) avoids arbitrage restoring price before borrow.
**Insight:** When a protocol prices an LP/position token, check whether the price source is the position's own pool spot price rather than a canonical high-TVL pool or TWAP; multiple UniV3 pools per pair let an attacker mint their own oracle.