# Deposit Theft by Crashing LP Spot Prices Through MEV

Ichi vault deposit pricing uses spot/twap min with same-block-only guard, letting a multi-block MEV attacker crash token price and steal depositors' funds.

- Payout: Contest reward
- Severity: medium
- Program: Blueberry
- Credited: Robert
- Disclosed: 2023-02-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-blueberry-judging/issues/220
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm technique:source-review vuln:flash-loan vuln:oracle-manipulation

**Target:** Ichi vault deposit pricing in Blueberry
**Root cause:** Deposit share pricing uses min(spot, twap) and only reverts on >5% deviation when the last price update was in the current block, so a prior-block manipulation passes the check.
**Steps:**
1. Attacker controls/uses MMEV on block N-1: manipulate token0 spot price in LP pool to near zero.
2. On block N, flash loan tokens and buy Ichi vault shares at the crashed price.
3. Include pending user deposits in block N; each receives near-zero shares.
4. Withdraw shares to capture the stolen tokens; restore price.
**How found:** Code review of Ichi vault deposit pricing: noticed min(spot,twap) with a same-block-only deviation guard, hypothesized cross-block manipulation bypasses the check.
**Exploitation:** Validator/MMEV searcher imbalances the LP pool the block before a controlled block, then flash-loans to buy vault shares cheaply while victim deposits are priced off the crashed spot, then withdraws to pocket the difference.
**Insight:** When a price guard only reverts if the last update was in the current block, test whether a prior-block manipulation slips through the deviation check on the next block.