# LPs can be griefed if there are active perpetual loans in the pool

Active perpetual loan causes LPs calling pour() to overpay; loan initiator resets/unwinds same block, griefing LP deposits.

- Payout: Contest reward
- Severity: medium
- Program: InfinityPools
- Credited: ktl
- Disclosed: 2025-01-13
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_infinitypools_october2024.pdf#3.2.4
- Library page: https://bugbountylibrary.com/r/cantina%3Ainfinitypools_october2024%3A3.2.4
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:chained technique:race-window vuln:business-logic

**Target:** InfinityPool.pour() / newLoan() / reset() / unwind()
**Root cause:** When a perpetual loan is active, pour() prices LP deposits including upfront interest owed to the loan, so the depositor pays more than the LP position reflects; the loan initiator can reset() and unwind() in the same block to reclaim the upfront interest.
**Steps:**
1. LP pours initial liquidity into pool.
2. Alice opens a large perpetual newLoan paying interest upfront.
3. Bob calls `pour(startTub, stopTub, liquidity, "")` depositing ~9.99e20 token0 and ~1.77e21 token1.
4. Alice calls `reset(swapperNum, 8192, 0, false, OPT_INT256_NONE, alice, "")` then `unwind(swapperNum, alice, "")` in the same block, recovering upfront interest.
5. Bob's LP position only reflects ~9.99e20 of each token; remainder lost.
**How found:** Reviewer reasoned that pour() pricing depends on active loan interest; hypothesized that a loan initiator could reset/unwind in the same block to recover upfront interest, then built a Foundry PoC to confirm the LP overpayment.
**Exploitation:** Attacker opens a perpetual loan paying interest upfront, waits for a victim LP to call pour(), then in the same block resets the loan to fixed and unwinds to reclaim the upfront interest, leaving the victim's overpayment stranded in the pool.
**Insight:** When deposit pricing depends on outstanding loan state, check whether the loan opener can atomically open, let a victim deposit, then close in one block to capture the pricing delta — griefing via same-block state toggling.