# ConvexSpell#closePositionFarm removes liquidity without any slippage protection

ConvexSpell.closePositionFarm calls Curve remove_liquidity_one_coin with min_out=0, letting attackers sandwich user withdrawals and steal value.

- Payout: Contest reward
- Severity: high
- Program: Blueberry
- Credited: 0x52
- Disclosed: 2023-04-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-blueberry-judging/issues/124
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AH-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** ConvexSpell/CurveSpell closePositionFarm Curve pool withdrawal
**Root cause:** remove_liquidity_one_coin is called with min_amount=0, so no slippage bound protects the single-token withdrawal from price manipulation.
**Steps:**
1. User calls closePositionFarm which invokes ICurvePool(pool).remove_liquidity_one_coin(amountPosRemove, int128(tokenIndex), 0)
2. Attacker observes pending tx and front-runs by skewing the Curve pool price for the target coin (flashloan-funded for low-liquidity pairs)
3. Victim's withdrawal executes at manipulated rate with min_out=0 accepting any output
4. Attacker back-runs to restore pool and pockets the difference
**How found:** Code review of the withdrawal path noticing the hardcoded 0 slippage argument to remove_liquidity_one_coin; same pattern in CurveSpell.
**Exploitation:** Sandwich: front-run to imbalance the Curve pool, let the victim's unprotected remove_liquidity_one_coin settle at the bad rate, then reverse the trade to capture the delta.
**Insight:** Audit every external AMM/Curve call for a hardcoded zero min_out/max_in; single-token remove_liquidity_one_coin is especially sandwichable on low-liquidity pairs.