# Attacker Can Inflate LP Position Value To Create a Bad Debt Loan

Salty.IO valued LP collateral using manipulable pool reserves, letting an attacker inflate LP price and borrow undercollateralized USDS.

- Payout: Contest reward
- Severity: medium
- Program: Salty.IO
- Credited: Banditx0x
- Disclosed: 2024-04-19
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-01-salty-findings/issues/222
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-27
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:oracle-manipulation

**Target:** USDS lending collateral valuation of Uniswap v2 style LP positions
**Root cause:** LP position value is computed from current pool reserves, which can be skewed by swaps, instead of a manipulation-resistant fair reserve ratio.
**Steps:**
1. Identify a USDS-collateralized LP pool where the attacker can deposit enough liquidity to dominate the pool.
2. Swap heavily in the pool to push reserves away from the oracle-implied ratio (e.g., x=2e18, y=0.5e18 while oracle price is $1 each).
3. LP position now values at $2.5 instead of $2 under oracle pricing.
4. Deposit the inflated LP as collateral and borrow USDS against the inflated value.
5. Dump/keep USDS; loan is undercollateralized and protocol accrues bad debt.
**How found:** Reasoned from the x*y=k invariant: any deviation from the oracle-correct ratio makes the LP worth more when valued by individual token USD prices, and LP is accepted as collateral for USDS.
**Exploitation:** Attacker deposits large liquidity to make the target pool dominate arbitrage paths, swaps to skew reserves, uses the inflated LP valuation as collateral to borrow USDS at a discount, then defaults; arbitrage losses are outweighed by borrowed USDS.
**Escalation:** Scaling pool liquidity to overwhelm automated WETH arbitrage paths so the skew persists long enough to borrow.
**Insight:** When a protocol values LP collateral from spot reserves, check whether an attacker can make their pool dominate the arbitrage path; if so, skewing reserves inflates collateral even with a correct oracle.