# Calling TermMaxMarket.setLsf leaks value to attackers via a sandwich attack

TermMaxMarket.setLsf changes virtual reserves, so an attacker can buy XT before an lsf reduction and sell after for profit.

- Payout: Contest reward
- Severity: high
- Program: TermMax
- Credited: Drastic Watermelon
- Disclosed: 2025-03-25
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_term_max_december2024.pdf#3.1.3
- Library page: https://bugbountylibrary.com/r/cantina%3Aterm_max_december2024%3A3.1.3
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** TermMaxMarket AMM pool (buyXt/sellXt/setLsf)
**Root cause:** Virtual reserves are derived by dividing real reserves by market.lsf; lowering lsf inflates virtual reserves, reducing perceived slippage and repricing the pool.
**Steps:**
1. Mint and approve underlying to market.
2. Frontrun: `res.market.buyXt(1800e8, 0)` to acquire XT at pre-update price.
3. Owner calls `res.market.setLsf(0.7e8)` (or 0.1e8) lowering lsf.
4. Backrun: `res.xt.approve(market, netOut)` then `res.market.sellXt(netOut, 0)`.
5. Assert final underlying balance > initial to confirm profit.
**How found:** Reviewer read TermMaxCurve virtual reserve math, noted both virtual reserves depend on market.lsf, and that setLsf is owner-callable within (0%,100%), implying price moves on lsf change — a sandwichable event.
**Exploitation:** Attacker buys XT before the owner's setLsf reduction and sells after; inflated virtual reserves lower slippage on the sell, extracting value from the pool. Larger lsf drops (80%→10%) yield larger profit; even 80%→70% is profitable.
**Insight:** When AMM pricing derives from a mutable parameter (here lsf dividing real reserves), treat any owner setter of that parameter as a price-moving event and test frontrun/backrun profitability across parameter deltas.