# Attacker can capture VETH-WETH depeg profits through a malicious pool, rendering rebalancer useless if VETH Price > WETH Price

rebalance() ORs an attacker-controlled directionMask with uniswapPool, letting a crafted mask redirect the OKX swap to a malicious VETH pool and steal depeg profits.

- Payout: Contest reward
- Severity: medium
- Program: Lambo.win
- Credited: rouhsamad
- Disclosed: 2025-02-03
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2024-12-lambowin#m-06
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** LamboRebalanceOnUniwap::rebalance / OKX Router swap
**Root cause:** rebalance() computes _v3pool = uniswapPool | directionMask with an unvalidated arbitrary mask, so an attacker can OR in bits to point the swap at their own pool instead of the legitimate WETH-VETH pool.
**Steps:**
1. Deploy malicious ERC20 whose transfer() forwards WETH to the rebalancer to repay flash loan + 1 wei profit.
2. Brute-force a salt (findSalt.js) so the VETH-TOKEN v3 pool address satisfies maliciousPool & ~uniswapPool == mask and mask | uniswapPool == maliciousPool.
3. Create the VETH-TOKEN v3 pool and mint one-sided liquidity (VETH side).
4. Call Attacker.takeProfit: Morpho flashLoan(WETH, amountIn+1) -> onMorphoFlashLoan sets token WETH amount and calls rebalancer.rebalance(mask, amountIn-1, 0).
5. rebalance ORs mask into uniswapPool, _executeSell mints discounted VETH and swaps it via OKXRouter into the malicious pool; malicious token transfer() repays loan+profit.
6. Withdraw liquidity, collect discounted VETH, sell it on the real market for more WETH than borrowed, repay flash loan, keep profit.
**How found:** Code review of rebalance(): noticed directionMask is an arbitrary uint256 ORed with uniswapPool and only compared against _BUY_MASK, so any other value falls into _executeSell with an attacker-influenced pool address.
**Exploitation:** Attacker needs a token/pool address matching the bitmask (brute-forced salt), one-sided VETH liquidity, and a Morpho flash loan. rebalance mints VETH at a discount when VETH>WETH, swaps it into the attacker's pool, whose token contract repays the loan plus 1 wei, leaving the discounted VETH with the attacker to sell at market price.
**Escalation:** Repeatable on every VETH-WETH depeg, permanently draining rebalancer profit.
**Insight:** When a contract builds an address by ORing a user-supplied mask into a trusted address, check whether the mask can set bits to redirect to an attacker-controlled contract; address-grinding via CREATE2 salt makes such redirection feasible.