# LP rewards in liquidity_lockbox can be arbitraged

liquidity_lockbox pays all accrued LP rewards to withdrawer with no lock-up, letting a depositor flash-deposit, withdraw, and harvest rewards repeatedly.

- Payout: Contest reward
- Severity: medium
- Program: Olas
- Credited: EV\_om
- Disclosed: 2024-02-06
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-autonolas-findings/issues/444
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-autonolas%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solana tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:reward-distribution

**Target:** Solana liquidity_lockbox contract (Orca LP position lockbox)
**Root cause:** withdraw() has no lock-up or restriction preventing immediate withdrawal after deposit and pays all accrued LP rewards to the caller, so rewards can be captured without holding a position.
**Steps:**
1. Obtain large token amount via flashloan or purchase
2. Open large Orca LP position and receive position NFT
3. Deposit NFT into liquidity_lockbox, receiving bridge tokens proportional to position size
4. Immediately call `withdraw()` using just-received tokens to pull existing positions and collect accrued LP rewards
5. Close positions in Orca pool, repay flashloan, keep rewards; repeat
**How found:** Code review of deposit/withdraw functions noting unrestricted immediate withdrawal and reward payout to caller in withdraw().
**Exploitation:** Attacker flash-borrows tokens, mints a large Orca LP position, deposits the NFT to receive bridge tokens, then withdraws existing positions with those tokens to collect all accrued LP rewards, closes positions and repays the loan, repeating for profit.
**Insight:** When a vault mints shares for deposits and pays accrued yield on withdrawal, check whether deposit-then-withdraw in the same block lets the caller harvest yield accrued by prior holders; flash-loanable deposit assets make this free.