# When a user single-side deposit into a pool, slippage protection is invalid

Single-side liquidity deposits in MANTRA pool-manager hardcode belief_price: None, so the pre-deposit swap's slippage check ignores pre-trade price movement, letting users mint far fewer LP shares than expected.

- Payout: Audit contest
- Severity: medium
- Program: MANTRA
- Found by: oakcobalt
- Disclosed: 2025-03-31
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-11-mantra-dex#m-11
- Library page: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AM-11
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** CosmWasm pool-manager provide_liquidity single-asset swap path
**Root cause:** provide_liquidity's single-asset branch executes Swap with belief_price hardcoded to None, so assert_max_spread falls back to spot-price-based spread that cannot detect price movement before tx execution; slippage_tolerance then compares against a moving pool ratio.
**Steps:**
1. Call provide_liquidity with a single deposit into a constant-product pool.
2. Contract issues internal Swap submessage with `belief_price: None` and user max_spread.
3. assert_max_spread uses spread_amount/(return_amount+spread_amount) against current spot price, ignoring pre-swap price drift.
4. Swap executes at whatever spot price exists at execution; resulting ask tokens and pool ratio differ from user expectation.
5. slippage_tolerance check compares deposit ratio to post-swap pool ratio, which is itself a moving target, so it passes despite poor minted LP shares.
**How found:** Code reading of provide_liquidity found belief_price hardcoded to None in the single-asset Swap submessage; traced into assert_max_spread to show the None branch relies on unforeseeable spot price, then constructed two pool-state scenarios showing slippage_tolerance passes while minted shares diverge.
**Exploitation:** User submits single-side deposit; between submission and execution the pool spot price shifts (e.g. via other swaps), the internal swap executes at the new price with no belief_price bound, and the user receives substantially fewer LP shares than a fair-price deposit would yield (PoC: 63 vs 158 LP).
**Insight:** In AMM wrappers that perform an internal swap before deposit, check whether the swap's slippage params (belief_price) are forwarded from the user; a downstream slippage_tolerance on deposit ratio is not equivalent because the swap itself moves the ratio it compares against.