# Uniswap Aggregated Fees Can be Increased at Close to Zero Cost

Attacker concentrates liquidity in active Uniswap v3 tick, wash-trades to inflate recorded fees, pushing IV up and LTV down to unfairly liquidate borrowers.

- Payout: Contest reward
- Severity: medium
- Program: Aloe
- Credited: Bandit
- Disclosed: 2023-10-11
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-10-aloe-judging/issues/45
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-aloe%3AM-5
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:flash-loan vuln:liquidation vuln:oracle-manipulation

**Target:** Aloe II volatility oracle reading Uniswap v3 feeGrowthGlobals
**Root cause:** Volatility (IV) is derived from Uniswap v3 fee growth, which an attacker can inflate cheaply by concentrating liquidity in the active tick and wash trading, or by overpaying a flash swap credited directly to fee growth globals.
**Steps:**
1. Deposit large capital into the active tickSpacing range of a liquid Uniswap v3 pool, capturing >99% of in-range liquidity.
2. Wash trade within that tick (or overpay a flash swap) so fees are credited to feeGrowthGlobals while price stays in range.
3. Recorded fees rise, driving IV upward and LTV downward.
4. Liquidate a pre-existing borrower whose position becomes underwater due to reduced LTV.
**How found:** Reasoned that only a tiny fraction of Uniswap v3 liquidity sits in the active tickSpacing, and 100% of fees go to in-range LPs, so a large LP can capture nearly all fees via wash trading; connected this to IV being computed from fee growth, enabling cheap LTV manipulation.
**Exploitation:** Attacker supplies capital to the active tick, performs self-matched swaps in one flashbots bundle so PnL and IL cancel, capturing >99% of fees and inflating feeGrowthGlobals; the resulting IV increase lowers LTV, making a target position liquidatable for profit.
**Insight:** When a protocol derives an oracle (volatility, TWAP, yield) from DEX fee growth, check whether an LP can dominate the active tick and self-trade to inflate that metric; also check if flash-swap overpayment is credited directly to fee growth globals.