# Manipulation of livePrice to receive defaultIncentive in 2 consecutive blocks

StabilizerNode's primed-window incentive can be claimed twice in consecutive blocks by manipulating livePrice via flash loan or sandwich, draining defaultIncentive Malt.

- Payout: Contest reward
- Severity: high
- Program: Malt Protocol
- Credited: minhquanym
- Disclosed: 2023-05-01
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-02-malt-findings/issues/14
- Library page: https://bugbountylibrary.com/r/c4%3A2023-02-malt%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** StabilizerNode.stabilize / _validateSwingTraderTrigger
**Root cause:** _validateSwingTraderTrigger uses manipulable spot livePrice to gate incentive minting and resets primedBlock after swing-trader trigger, allowing a second mint one block later while twap is still below entry price.
**Steps:**
1. Block i: twap below getSwingTraderEntryPrice(); call `stabilize()` to mint `defaultIncentive`, sets `primedBlock = block.number`.
2. Block i+1: `_validateSwingTraderTrigger()` returns true, swing trader triggers, `primedBlock` reset to 0, AMM transfers unblocked.
3. Twap still below entryPrice; use flash loan to push `livePrice > entryPrice` on the AMM pool.
4. Call `stabilize()` again to mint `defaultIncentive`; repay flash loan.
5. Net cost only flash-loan fee since auction started but swing trader not triggered.
**How found:** Code reading of _validateSwingTraderTrigger: noticed livePrice (spot, manipulable) gates minting while twap moves slowly, and primedBlock reset after swing-trader trigger permits a second mint one block later.
**Exploitation:** Attacker flash-loans pool liquidity to move livePrice above entryPrice within one block, calls stabilize() to mint defaultIncentive, repays loan; AMM state restored except fee. Alternatively sandwich the legitimate stabilize tx to bypass onlyEOA.
**Escalation:** Repeat each primedWindow cycle to farm incentives; judge notes feeless flash loans (e.g. Euler) make capital cost ~0, leaving only AMM manipulation cost.
**Insight:** When an incentive mint is gated on a spot price but the underlying condition (twap) updates slowly, check whether the gate can be re-satisfied within the same slow-update window; also check whether a reset path (swing trader) re-arms the mint before the slow oracle catches up.