# Pool creators can manipulate the slippage calculation for liquidity providers

Permissionless pool creation accepts unsorted asset denoms, inverting the slippage ratio check and letting LPs be drained via misordered pools.

- Payout: Audit contest
- Severity: high
- Program: MANTRA
- Found by: DadeKuma
- Disclosed: 2025-03-31
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2024-11-mantra-dex#h-12
- Library page: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-12
- Tags: area:web3 domain:oss domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** CosmWasm pool-manager contract (create_pool / provide_liquidity)
**Root cause:** create_pool stores asset_denoms in caller-supplied order while deposits are always sorted, so assert_slippage_tolerance compares deposits against an inverted pool ratio.
**Steps:**
1. Call `pool_manager::create_pool` with asset_denoms `["uwhale","uluna"]` (unsorted) to create pool `o.whale.uluna`.
2. Provide initial liquidity `[100000 uwhale, 1000000 uluna]`.
3. Provide second liquidity `[1000000 uluna, 120000 uwhale]` with `slippage_tolerance=0.6`.
4. Observe ratio check uses deposits[0]/deposits[1] vs pools[0]/pools[1] with mismatched ordering: `3.33 > 0.1` and `0.048 > 10`, passing an otherwise-invalid deposit.
5. Recreate pool with sorted `["uluna","uwhale"]` and same deposits to see the check correctly reject.
**How found:** Noticed pool creation is permissionless and accepts arbitrary denom order; compared against other code paths that always sort denoms, hypothesized the slippage helper assumes sorted pool_assets, then instrumented the ratio check with println to confirm inversion.
**Exploitation:** Pool creator picks the denom order that inverts the ratio; subsequent LPs' slippage tolerance is evaluated against the wrong ratio, allowing deposits far outside intended tolerance and diluting/losing LP funds.
**Insight:** When a helper assumes canonical ordering (sorted denoms) but the caller-controlled creation path doesn't enforce it, look for ratio/price math that silently inverts; instrument the comparison to expose mismatched index ordering.