# Tokens without UniV3 pairs with `tokenToBeneficiary` can be stolen by an attacker

Swapper oracle prices tokens via UniV3 TWAP; attacker creates a near-zero-liquidity pool for a token lacking a real pair and swaps to steal it.

- Payout: Contest reward
- Severity: medium
- Program: Splits
- Credited: ctf_sec
- Disclosed: 2023-04-06
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-04-splits-judging/issues/26
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-splits%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:oracle-manipulation

**Target:** UniV3OracleImpl.sol TWAP oracle in Splits Swapper
**Root cause:** Oracle derives price solely from a UniV3 pool's TWAP without checking pool liquidity or existence/age, so an attacker-created pool with negligible liquidity sets an arbitrary price.
**Steps:**
1. Identify a token held by a Swapper that has no direct UniV3 pool with `tokenToBeneficiary` (e.g. MATIC/WBTC, MAKER/FRAX).
2. Create a UniV3 pool for that token pair and seed it with tiny liquidity at a ratio valuing the token at ~0.
3. Hold the price for the TWAP window; low liquidity means arbitrage bots ignore it.
4. Call the Swapper swap from the token to `tokenToBeneficiary`, paying ~0 and receiving the tokens.
**How found:** Code review of UniV3OracleImpl TWAP logic; noticed oracle only supports direct pools and does not validate liquidity or pool age, then reasoned that unlisted pairs (common via multi-hop) leave tokens priced by an attacker-controlled pool.
**Exploitation:** Attacker spins up a new UniV3 pool for the unpaired token, seeds minimal liquidity at a near-zero price, sustains it through the TWAP period, then swaps the Swapper's tokens out at the manipulated price, extracting them for ~nothing.
**Insight:** When an oracle reads a single DEX pool's TWAP, check whether the pool can be permissionlessly created and whether liquidity/age is validated — unpaired assets are the exploitable gap.