# Anyone can deploy a new FraxSwapPair with a Low fee incurring losses to the protocol

Anyone can pre-create a FraxSwapPair for an agent token with 0.01% fee, so moveLiquidity deposits LP into the low-fee pool and the agent earns reduced swap fees.

- Payout: Contest reward
- Severity: medium
- Program: IQ AI
- Credited: CodexBugmenot
- Disclosed: 2025-03-19
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-01-iq-ai#m-01
- Library page: https://bugbountylibrary.com/r/c4%3A2025-01-iq-ai%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:misconfiguration

**Target:** LiquidityManager.moveLiquidity / FraxSwapFactory pair creation
**Root cause:** moveLiquidity reuses any existing FraxSwapPair for the token pair instead of creating/validating one with the intended 1% fee, so an attacker-created pair with 0.01% fee is adopted.
**Steps:**
1. Griefer buys from BootstrapPool to obtain minimum liquidity of agent token.
2. Griefer calls `fraxswapFactory.createPair(currencyToken, token, 1)` (fee=1 → 0.01%) before moveLiquidity.
3. Griefer seeds the pair with currencyToken and agent token and calls `fraxswapPair.mint(griefer)`.
4. Call `manager.moveLiquidity()`; protocol liquidity lands in the low-fee pair.
5. Swap via `fraxswapPair.swap` and observe amountOut 3.935e18 vs 3.896e18 at 1% fee, i.e. ~0.039 ETH fee loss per 1 ETH swap.
**How found:** Code reading of moveLiquidity's pair lookup revealed it accepts a pre-existing pair without checking its fee against the configured tradingFee.
**Exploitation:** Attacker front-runs moveLiquidity by deploying the pair at minimal fee and seeding it, capturing swap fees that would otherwise accrue to the agent/TokenGovernor until Fraxswap owner resets the fee.
**Insight:** When a manager function adopts an externally creatable registry object (factory pair/pool) by lookup, check whether an attacker can pre-register that object with attacker-chosen parameters before the manager's first use.