# CurveVolatileCollateral Collateral status can be manipulated by flashloan attack

CurveVolatileCollateral's pool-balance depeg check can be skewed by a flash-loan deposit, marking collateral IFFY then defaulted, forcing basket to sell off the collateral.

- Payout: Contest reward
- Severity: high
- Program: Reserve
- Credited: ronnyx2017
- Disclosed: 2023-11-13
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-reserve-findings/issues/22
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** CurveVolatileCollateral / CurveStableCollateral.refresh() collateral status logic
**Root cause:** _anyDepeggedInPool flags depeg when any single token's share of pool value exceeds expected by _defaultThreshold; a temporary large deposit skews the distribution without any real depeg.
**Steps:**
1. Assume CurveVolatileCollateral over TriCrypto ETH/WBTC/USDT with 1:1:1 expected and _defaultThreshold 5%; pool holds 1000 USDT balanced.
2. Flash-loan 500 USDT and deposit into the pool: USDT share becomes 1500/(1500+1000+1000)=42.86%.
3. Call refresh() on the collateral; observed-expected = 42.86%-33.33% = 9.53% > 5%, so markStatus(IFFY).
4. Withdraw the deposit and repay the flash loan.
5. Wait delayUntilDefault; alreadyDefaulted() returns true and collateral is marked defaulted, triggering basket rebalance selling off the collateral.
**How found:** Code reading of _anyDepeggedInPool's distribution check and CurveStableCollateral.refresh() status logic; recognized the check depends on manipulable pool balances.
**Exploitation:** Attacker flash-loans tokens, temporarily deposits into the underlying Curve pool to skew token distribution past the threshold, calls refresh() to mark collateral IFFY, withdraws and repays, then waits for delayUntilDefault to force default and basket rebalance/sell-off.
**Escalation:** IFFY status escalates to defaulted after delayUntilDefault, causing the basket to rebalance and dump the collateral.
**Insight:** Depeg/oracle checks that compare pool token distribution to an equal-weight expectation are flash-loan manipulable; prefer external LP price checks over instantaneous pool composition.