# The vault allows "free" swaps from WETH to RDPX

Dopex PerpetualAtlanticVaultLP redeems rdpx by vault proportion rather than current price, letting depositors swap WETH→rdpx fee-free and arbitrage depositors.

- Payout: Contest reward
- Severity: medium
- Program: Dopex
- Credited: LokiThe5th
- Disclosed: 2023-12-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-08-dopex-findings/issues/2130
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** PerpetualAtlanticVaultLP vault contract (deposit/redeem)
**Root cause:** redeem computes rdpx owed as shares.mulDivDown(_rdpxCollateral, supply), ignoring current rdpxPriceInEth, so payout tracks vault proportion not market value.
**Steps:**
1. Deposit WETH via `vaultLp.deposit(1 ether, user)` to mint shares
2. Call `vaultLp.redeemPreview(userBalance)` at rdpx price 0.010 gwei, record rdpx amount
3. Change oracle price to 0.020 gwei via `priceOracle.updateRdpxPrice`; redeemPreview returns identical rdpx amount
4. Add rdpx collateral via `vaultLp.addRdpx(10 ether)`; redeemPreview now returns more rdpx for same shares
**How found:** Code reading of redeem/redeemPreview: noticed rdpx payout uses _rdpxCollateral/supply ratio instead of oracle price used in deposit share minting; wrote Foundry PoC asserting rdpx amount invariant to price changes but sensitive to collateral.
**Exploitation:** User deposits WETH, immediately redeems to receive proportional WETH+rdpx, effectively swapping WETH→rdpx without paying AMM swap fees, potentially at a discount to market price; value extracted from existing vault depositors.
**Insight:** When a vault mints shares using an oracle price but redeems underlying by raw proportion, the mismatch is an arbitrage surface—check that both mint and redeem legs use the same valuation source.