# TalosBaseStrategy#init() lacks slippage protection

TalosBaseStrategy.init() mints a Uniswap V3 position with amount0Min/amount1Min hardcoded to 0 and skips the checkDeviation modifier, exposing initial depositors to slippage/price manipulation.

- Payout: Contest reward
- Severity: high
- Program: Maia DAO Ecosystem
- Credited: AlexCzm
- Disclosed: 2023-09-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/658
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:oracle-manipulation

**Target:** TalosBaseStrategy.init() Uniswap V3 position mint
**Root cause:** init() calls _nonfungiblePositionManager.mint() with amount0Min=0 and amount1Min=0, and omits the checkDeviation modifier that guards deposit/redeem/rerange/rebalance against price deviation.
**Steps:**
1. Call `init(amount0Desired, amount1Desired, receiver)` on TalosBaseStrategy.
2. Observe mint() invoked with `amount0Min: 0, amount1Min: 0` and no checkDeviation modifier.
3. Manipulate pool price before/at init so the mint deposits at an unfavorable ratio, capturing the slippage loss.
**How found:** Noticed checkDeviation modifier applied to deposit/redeem/rerange/rebalance but absent on init(), then read init() and saw mint() hardcodes amount0Min/amount1Min to 0.
**Insight:** When a contract has a deviation/slippage guard modifier, enumerate every state-changing liquidity entrypoint (including one-time init/mint paths) for its absence and for hardcoded zero min-amount args.