# Ineffective slippage control

Olas Lockbox deposit derives requested liquidity from token_max_a at spot price, letting an attacker sandwich the LP deposit and shortchange the depositor's liquidity.

- Payout: Contest reward
- Severity: high
- Program: Olas Lockbox
- Credited: 99Crits
- Disclosed: 2024-03-11
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_olas_lockbox_jan2024.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Aolas_lockbox_jan2024%3A3.1.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:solana technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Solana Anchor deposit instruction (lib.rs) forwarding to Orca Whirlpool increase_liquidity
**Root cause:** deposit computes liquidity_amount from token_max_a at the current on-chain sqrt_price instead of a user-signed target liquidity, so manipulated spot price changes the liquidity received.
**Steps:**
1. Attacker buys up token B to push pool sqrt_price down.
2. Victim deposit executes: get_liquidity_from_token_a uses lowered sqrt_price_lower, yielding reduced liquidity_amount and skewed delta_a/delta_b.
3. increase_liquidity CPI mints far less liquidity than intended for the depositor.
4. Attacker sells token B back at improved price, profiting from the added liquidity.
**How found:** Code review of deposit: noticed liquidity_amount derived from token_max_a at current sqrt_price rather than a user-committed liquidity target, making it price-manipulable.
**Exploitation:** Sandwich via Jito Bundles: front-run buy of token B, victim deposit at skewed price receives reduced liquidity, back-run sell of token B captures profit.
**Insight:** When an LP deposit sizes liquidity from a max-token amount at spot price, the received liquidity is manipulable; check whether the user signs an explicit liquidity_amount like Orca's increase_liquidity interface.