# You can deposit and withdraw simultaneously in the same block to manipulate exchangerate

Opal Omnipool's same-block deposit/withdraw guard is per-address, so two accounts sharing a transferable LP token bypass it and manipulate exchangeRate.

- Payout: Contest reward
- Severity: critical
- Program: Opal
- Credited: 8olidity
- Disclosed: 2024-03-30
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_opal_feb2024.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.1.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Omnipool.sol depositFor/withdraw LP token accounting
**Root cause:** Same-block deposit/withdraw restriction keyed on msg.sender (lastTransactionBlock) rather than the LP position; LP tokens are freely transferable, so a second address can withdraw in the same block.
**Steps:**
1. Alice calls `pool.deposit(10000e6, 1)` with USDC in block N
2. Alice transfers LP tokens to Bob via `IERC20(lpToken).transfer(bob, stakedBalance)`
3. Bob calls `pool.withdraw(withdrawAmount, withdrawAmount/2)` in the same block N
4. Guard `lastTransactionBlock[msg.sender] == block.number` never triggers because msg.sender differs
**How found:** Code review of the same-block guard in depositFor/withdraw; noticed the check is per-msg.sender while LP tokens are ERC20-transferable, hypothesizing a two-account bypass.
**Exploitation:** Attacker controls two addresses; deposits to move exchangeRate, transfers LP to second address, withdraws same block at manipulated rate; can sandwich a large third-party deposit to extract value.
**Escalation:** Chain with a large victim deposit between attacker deposit and second-account withdrawal to amplify exchangeRate skew.
**Insight:** When a rate-manipulation guard is keyed on msg.sender, check whether the position/share token is transferable — a second address inherits the position and evades the guard.