# Malicious user can DOS pool and avoid liquidation by creating secondary liquidity pool for Velodrome token pair

DepositReceipt prices liquidity via Velodrome router which picks best of stable/volatile pools; attacker skews the wrong pool so liquidation pricing reverts, avoiding liquidation.

- Payout: Contest reward
- Severity: high
- Program: Isomorph
- Credited: 0x52
- Disclosed: 2022-11-05
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-11-isomorph-judging/issues/72
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-11-isomorph%3AH-4
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:dos vuln:liquidation vuln:oracle-manipulation

**Target:** Velo-Deposit-Tokens DepositReceipt priceLiquidity / Velodrome router
**Root cause:** priceLiquidity calls router.getAmountOut which returns the best rate across stable and volatile pools, then requires stablePool==stable; if the opposite pool quotes better the require reverts, so pricing (and thus liquidation) fails.
**Steps:**
1. Attacker holds a Vault_Velo position backed by a DepositReceipt for a token pair with both stable and volatile Velodrome pools.
2. priceLiquidity calls `router.getAmountOut(HUNDRED_TOKENS, token1, USDC)` and requires `stablePool == stable`.
3. Attacker manipulates the price of the opposite (wrong) pool so it returns the better rate.
4. Any liquidation call invokes priceLiquidity, routes through the wrong pool, and reverts on the require, blocking liquidation.
**How found:** Code reading of priceLiquidity: noticed the router auto-selects the best pool while the code hard-requires a specific pool type, making the require attacker-controllable via pool price manipulation.
**Exploitation:** Attacker skews the non-target Velodrome pool's price so the router always selects it; liquidation transactions then revert at the stablePool require, letting an underwater position persist indefinitely.
**Insight:** When a contract quotes via an aggregator/router that auto-selects among pools but then asserts a specific pool was used, the assertion becomes an attacker-controllable revert; quote the intended pool directly via pairFor.