# Adversary can economically exploit wstETHLiquidityVault

Single-sided wstETH liquidity vault mints OHM as counter-asset; attacker deposits, buys OHM within price threshold, withdraws, and dumps OHM for profit.

- Payout: Contest reward
- Severity: high
- Program: Olympus
- Credited: Bahurum
- Disclosed: 2023-03-06
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-02-olympus-judging/issues/110
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-olympus%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:oracle-manipulation

**Target:** SingleSidedLiquidityVault (wstETH/OHM Balancer pool)
**Root cause:** Vault mints OHM to match wstETH deposit and burns OHM on withdrawal, absorbing impermanent loss from OHM price movement between deposit and withdraw; attacker captures that discrepancy.
**Steps:**
1. Deposit wstETH into SingleSidedLiquidityVault, causing vault to mint OHM as counter-asset into Balancer pool
2. Buy OHM from the pool, keeping price movement within THRESHOLD so isPoolSafe passes
3. Withdraw wstETH from vault (OHM burned, wstETH returned)
4. Sell acquired OHM back for wstETH at profit; loop
**How found:** Reasoned about vault's mint/burn accounting vs. Balancer pool price movement between deposit and withdrawal, recognizing the vault absorbs IL that an attacker can capture within the isPoolSafe threshold.
**Exploitation:** Attacker deposits wstETH, manipulates OHM price within the allowed threshold by buying OHM, withdraws wstETH (vault burns less OHM than minted due to price increase), then dumps the acquired OHM for wstETH, netting profit each loop; can also push price to lower threshold first for larger gain.
**Escalation:** Loop the deposit/buy/withdraw/dump cycle repeatedly; tighter THRESHOLD only raises required capital, not profitability.
**Insight:** When a vault mints/burns a counter-asset against an AMM position, check whether price movement between deposit and withdraw lets the user capture the vault's IL within any safety threshold; thresholds bound capital, not profitability.