# Exchange Rate can be manipulated if positions are big enough for a long enough time

Large long positions held for weeks skew the funding rate and mark price, letting an attacker manipulate KangarooVault share valuation and leak value on withdrawals.

- Payout: Contest reward
- Severity: medium
- Program: Polynomial Protocol
- Credited: GalloDaSballo
- Disclosed: 2023-08-01
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-03-polynomial-findings/issues/263
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-polynomial%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:oracle-manipulation vuln:share-inflation

**Target:** KangarooVault / Exchange mark price and funding rate
**Root cause:** Mark price is derived from funding rate, which accrues over time based on open interest; a sufficiently large long position held long enough shifts funding rate and thus mark price, which feeds getTokenPrice used to value KangarooShares.
**Steps:**
1. Deploy test system, init pool/exchange, set asset price to 1200e18
2. Deposit 1e40 sUSD as user_3 into pool
3. Open a long of 1e26 (1B) with maxCost 1e34 as user_2
4. `vm.warp(block.timestamp + 20 weeks)`
5. Observe `getFundingRate()` changed from 0 and `getMarkPrice()` shifted from 720000000000000000000 to 719999999999999999280
6. Withdraw KangarooShares valued at manipulated mark price to leak value
**How found:** Researcher hypothesized that exchangeRate could be manipulated via markPrice -> getTokenPrice, then tested by opening a huge long and warping time to confirm funding rate and mark price drift.
**Exploitation:** Attacker needs ~100M-1B capital and at least ~1 week of position holding to move funding rate and mark price, then withdraws KangarooVault shares at the skewed valuation to extract value or grief other withdrawers.
**Insight:** When share price depends on a time-accrued funding rate driven by open interest, check whether a single large position held across funding epochs can shift the valuation oracle enough to profit on deposit/withdraw.