# Min deposit protection during rebalancing can be bypassed if multiple fee tiers

Arrakis rebalance slippage check aggregates liquidity across multiple fee tiers, letting an attacker sandwich pools in opposite directions and force worse-price deposits.

- Payout: Contest reward
- Severity: medium
- Program: Arrakis
- Credited: cergyk
- Disclosed: 2023-06-05
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-arrakis-judging/issues/28
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-arrakis%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm technique:chained vuln:business-logic vuln:oracle-manipulation

**Target:** ArrakisV2 vault rebalance() liquidity minting across multiple Uniswap fee tiers
**Root cause:** The min-deposit slippage check compares aggregate liquidity added across pools sharing tokens but different fee tiers; imbalanced pools in opposite directions can yield the same aggregate liquidity at worse prices.
**Steps:**
1. Vault covers WETH-USDC range 1200-2000 across fee tiers 0.3% and 0.5%; WETH at 1600.
2. Operator Bob submits rebalance() minting liquidity into both pools.
3. Alice front-runs, pushing WETH price to 1200 on the 0.3% pool and to 2000 on the 0.5% pool.
4. Bob's rebalance executes, depositing more WETH/USDC for the same aggregate liquidity; the aggregate slippage check passes.
5. Alice back-runs to unwind her price manipulation for profit.
**How found:** Noticed the slippage protection at ArrakisV2.sol#L408-L409 works per-pool but is applied to an aggregate across multiple fee tiers; reasoned that opposite-direction imbalances cancel out in the aggregate check.
**Exploitation:** Sandwich the operator's rebalance transaction: manipulate each fee-tier pool in opposite directions so the aggregate liquidity check still passes while the operator deposits at worse prices, then reverse the trades to capture the difference.
**Insight:** When a slippage/min-deposit guard aggregates liquidity across multiple pools of the same pair, per-pool price deviations can offset each other; check whether the guard should be grouped per fee tier rather than summed.