# IV Can be Decreased for Free

Aloe's IV is computed from single-block tickSpacing liquidity, so an attacker can deposit liquidity, call update, and withdraw to lower IV for free, inflating LTV.

- Payout: Contest reward
- Severity: high
- Program: Aloe
- Credited: Bandit
- Disclosed: 2023-10-11
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-10-aloe-judging/issues/63
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation vuln:oracle-manipulation

**Target:** Volatility.sol IV estimation / lending LTV
**Root cause:** IV estimate divides by tickTvl taken only from the current block's active tickSpacing liquidity, which can be transiently inflated at near-zero capital cost.
**Steps:**
1. Deposit a large amount of liquidity into the active tickSpacing (small fraction of pool total, so cheap).
2. Call `update` so the IV estimate reads the inflated `tickTvl`.
3. Withdraw the deposited liquidity; IV remains lowered.
4. Repeat across updates to bypass `IV_CHANGE_PER_UPDATE` and drive IV down to raise LTV toward 90%.
**How found:** Code reading of Volatility.sol: noticed `tickTvl` divides the estimate and is sourced only from the current block's single tickSpacing, making it cheaply manipulable versus price manipulation which costs trading fees.
**Exploitation:** Attacker inflates in-range tick liquidity for one block, triggers update to lower IV, then removes liquidity; only gas is spent since no trading occurs. Lower IV raises allowed LTV, enabling over-leverage and avoiding liquidation.
**Escalation:** Repeated updates bypass the per-update IV change cap, compounding the LTV increase over time.
**Insight:** When a risk parameter is derived from instantaneous in-range liquidity, check whether that liquidity can be added and removed within the same block/update cycle at near-zero cost; per-update rate limits only slow, not prevent, such manipulation.