# Users can prevent protocol from rebalancing for his gain and cause loss of funds for protocol and its users

Attacker front-runs LamboRebalanceOnUniwap.rebalance with a Uniswap swap that skews vETH/ETH ratio, forcing the profit>0 check to revert and DoS-ing repeg.

- Payout: Contest reward
- Severity: medium
- Program: Lambo.win
- Credited: mrMorningstar
- Disclosed: 2025-02-03
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-lambowin#m-08
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-08
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:dos vuln:oracle-manipulation

**Target:** LamboRebalanceOnUniwap.rebalance / UniswapV3 vETH-ETH pool
**Root cause:** rebalance requires profit > 0 after a flash-loan swap; an attacker can move the pool price so the swap yields no profit, reverting the whole rebalance.
**Steps:**
1. Monitor mempool for rebalance(directionMask, amountIn, amountOut) calls.
2. Front-run by swapping WETH->vETH on the UniswapV3 pool to inflate vETH price.
3. rebalance executes: Morpho flash loan taken, swap returns less vETH than needed.
4. profit = balanceAfter - balanceBefore <= 0, so `require(profit > 0)` reverts.
5. Attacker keeps gained vETH and swaps it via LamboVETHRouter (assumes 1:1 vETH/ETH) into other Lambo tokens for profit.
**How found:** Code review of rebalance's `require(profit > 0)` and observation that pool price is externally manipulable via front-running; noted LamboVETHRouter assumes 1:1 vETH/ETH.
**Exploitation:** Attacker front-runs each rebalance with a pool swap that skews the ratio enough to make the flash-loan swap unprofitable, reverting rebalance; then uses acquired vETH against LamboVETHRouter's 1:1 assumption to inflate other pools and extract value.
**Escalation:** Repeated front-running keeps protocol depegged while attacker profits from mispriced vETH in other Lambo pools.
**Insight:** When a keeper/rebalance function requires profit>0 after an AMM swap, an attacker can sandwich it to force a revert; check whether the profit gate is manipulable and whether downstream routers hardcode the peg ratio.