# No slippage check in remove_liquidity function in omnipool can lead to slippage losses during liquidity withdrawal.

HydraDX omnipool remove_liquidity lacks a minimum_amount_out slippage parameter, letting a frontrunner move the spot price and cost LPs up to ~2% on withdrawal.

- Payout: Contest reward
- Severity: medium
- Program: HydraDX
- Credited: carrotsmuggler
- Disclosed: 2024-04-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-hydradx-findings/issues/93
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-hydradx%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** omnipool pallet remove_liquidity extrinsic (Substrate)
**Root cause:** remove_liquidity has no user-supplied minimum_amount_out; only the ensure_price oracle check bounds deviation to ~1% per side, allowing up to ~2% slippage.
**Steps:**
1. LP adds liquidity to omnipool for token_1000 (baseline: 5000 ONE -> 4990 ONE after remove, 0.1% fee).
2. Attacker frontruns with `Omnipool::buy(LP1, 1_000, LRNA, 300*ONE, 500000*ONE)` to move token_1000 spot price.
3. Victim calls `Omnipool::remove_liquidity(LP3, position_id, position.shares)` with no min-out.
4. Victim receives fewer token_1000 (4961.89 ONE for sell-side, 4958.57 ONE for buy-side) — ~1% loss vs baseline.
5. If LRNA is received, victim swaps LRNA->token_1000, which the attacker can sandwich again.
**How found:** Code review of remove_liquidity noticed absence of a minimum_amount_out parameter; built a Substrate test harness comparing baseline vs frontrun scenarios to quantify slippage.
**Exploitation:** Attacker observes a pending remove_liquidity, swaps to push spot price toward the 1% oracle bound, victim withdraws at the manipulated price, attacker reverses the swap for profit; losses capped near 2% by ensure_price.
**Insight:** When an AMM withdrawal relies only on an oracle price-band check instead of a user min-out, the band itself becomes the attacker's profit ceiling — check every liquidity-removal path for a caller-supplied slippage bound.