# LidoEthStrategy._currentBalance is subject to price manipulation, allows overborrowing and liquidations

LidoEthStrategy valued stETH via Curve get_dy spot quote, letting an attacker imbalance the pool to overborrow or force liquidations.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: GalloDaSballo
- Disclosed: 2023-11-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/1432
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:flash-loan vuln:liquidation vuln:oracle-manipulation

**Target:** LidoEthStrategy._currentBalance / Curve stETH-ETH pool get_dy
**Root cause:** Strategy prices stETH by querying Curve pool get_dy(1,0,balance), a spot quote manipulable by swapping in the same pool, instead of a manipulation-resistant oracle.
**Steps:**
1. Swap large ETH->stETH (or stETH->ETH) into Curve stETH pool `0xDC24316b9AE028F1497c275EB9192a3Ea0f67022` via `exchange(0,1,msg.value,0)` to move get_dy(1,0,balance)
2. Observe get_dy(1,0,5455e18) jump from ~5443e18 to ~9755e18 with 100k ETH swap
3. With inflated _currentBalance, borrow against the strategy beyond true collateral value
4. Reverse the swap to undervalue stETH, then liquidate depositors at attacker-controlled premium
**How found:** Code reading: noticed _currentBalance calls curveStEthPool.get_dy for a spot quote (with a TODO noting manipulatable view-reentrancy), then wrote Foundry tests swapping 100k/700k ETH to confirm the quote doubles.
**Exploitation:** Attacker flash-loans/swaps large stETH or ETH through the Curve pool to skew get_dy, inflating the strategy's reported balance to overborrow against it, or deflating it to trigger liquidations; 1BPS swap fee makes it profitable at low TVL.
**Escalation:** Chains overborrow to make the Singularity insolvent, or price crash to liquidate all depositors at optimal premium.
**Insight:** Any strategy that marks collateral value using a same-pool spot quote (get_dy/get_virtual_price) is flash-swappable; check _currentBalance-style valuation functions for Curve/AMM spot reads rather than Chainlink/TWAP.