# Gas Coin Setup Result In Immediate Profitable Arbitrage

New gas-coin pools seeded with fixed 0.1/0.1 liquidity create mispriced reserves, letting anyone backrun the liquidity add and arbitrage for instant profit.

- Payout: Contest reward
- Severity: medium
- Program: ZetaChain
- Credited: MevSec
- Disclosed: 2024-09-06
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-11-zetachain-findings/issues/580
- Library page: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm technique:recon technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** System contract gas coin pool setup (SetupChainGasCoinAndPool / DeployFungibleCoinZRC20)
**Root cause:** SetupChainGasCoinAndPool seeds every new gas-coin pool with a fixed 0.1 ZETA / 0.1 gas-ZRC20 ratio regardless of the real relative value of the two assets, leaving reserves badly mispriced for high-value coins like BTC/ETH/SOL.
**Steps:**
1. Monitor for DeployFungibleCoinZRC20 messages adding a new blockchain's gas ZRC20.
2. Confirm pool reserves via `cast call <pair> "getReserves()(uint112,uint112,uint32)"` showing 1e17/1e17 (or 1e17/1e7 for BTC).
3. Backrun the addLiquidityETH transaction by swapping ZETA into the pool at the skewed ratio.
4. Withdraw/redeem the acquired gas ZRC20 for native tokens to realize profit.
**How found:** Reading the DeployFungibleCoinZRC20 flow and SetupChainGasCoinAndPool, noticed the hardcoded 0.1/0.1 seeding; verified on-chain via cast that reserves for ETH and BTC pools were 1e17/1e17 and 1e17/1e7, showing severe value imbalance.
**Exploitation:** Attacker watches for new chain support, then backruns the liquidity-add tx by swapping ZETA for the underpriced gas ZRC20, capturing the imbalance as instant profit redeemable for native tokens.
**Insight:** When a protocol seeds AMM pools at deploy time with a fixed nominal ratio, compare that ratio to real asset prices—high-value gas tokens paired 1:1 with a low-value token create a guaranteed backrunnable arbitrage.