# Griefing attack on GenesisPoolManager.sol::depositNativeToken leading to Denial of Service

Attacker pre-creates the LP pair for a pending Genesis Pool and seeds it with 1 wei, making depositNativeToken's zero-balance check revert and blocking pool launch.

- Payout: Contest reward
- Severity: medium
- Program: Blackhole
- Credited: FavourOkerri
- Disclosed: 2025-07-03
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-05-blackhole#m-05
- Library page: https://bugbountylibrary.com/r/c4%3A2025-05-blackhole%3AM-05
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window vuln:business-logic vuln:dos

**Target:** GenesisPoolManager.depositNativeToken / PairFactory.createPair (Solidity contracts)
**Root cause:** depositNativeToken only checks that an existing pair has zero token balances, not that the protocol itself created the pair, so anyone can pre-create and seed it.
**Steps:**
1. Observe pending GenesisPoolFactory.createGenesisPool tx in mempool or its GenesisCreated event to learn nativeToken, fundingToken, stable.
2. Call `pairFactory.createPair(nativeToken, fundingToken, stable)` to create the empty pair.
3. Transfer 1 wei of nativeToken and 1 wei of fundingToken directly to the new pair address.
4. Legitimate `depositNativeToken` calls `pairFactory.getPair(...)`, hits the attacker pair, and reverts on `require(IERC20(token).balanceOf(pairAddress) == 0, "!ZV")`.
**How found:** Noticed that pair addresses are public via mempool/GenesisCreated event, that createPair is permissionless, and that depositNativeToken validates only pair balances rather than pair provenance.
**Exploitation:** Front-run the pool creation by creating the pair and dusting it with 1 wei of each token; the victim's depositNativeToken reverts on the zero-balance require, blocking the Genesis Pool launch at minimal gas cost.
**Insight:** When a contract treats 'pair exists and is empty' as proof it is protocol-owned, check whether pair creation is permissionless and front-runnable; dust-seeding an attacker-created pair defeats zero-balance guards.