# Pool can be drained if there are no LP_FEES

Dodo GSP PMMPricing misprices swaps when a reserve hits zero, letting a flash-loan attacker drain the pool by selling base to zero quote then swapping back.

- Payout: Contest reward
- Severity: high
- Program: Dodo Gsp
- Credited: cergyk
- Disclosed: 2023-12-14
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-12-dodo-gsp-judging/issues/122
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-dodo-gsp%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:fuzzing vuln:accounting-error vuln:flash-loan vuln:oracle-manipulation

**Target:** GSPTrader.sol swap/sellBase/sellQuote pricing
**Root cause:** Swaps allow withdrawing the entire reserve of an asset, leaving it at 0; PMMPricing then computes output amounts incorrectly for the depleted state, overpaying on the reverse swap.
**Steps:**
1. Initialize pool with 10 DAI / 10 USDC via buyShares.
2. Attacker sells `99959990000000000000000` DAI via `sellBase`, driving `_QUOTE_RESERVE_` to 0.
3. Attacker transfers received USDC back and calls `sellQuote`.
4. PMMPricing with zero quote reserve overpays base; `receivedBaseAmount >= _amount`, yielding profit.
**How found:** Fuzzed the sell amount to find the value that drives quote reserve to exactly 0, then observed PMMPricing misprices the reverse swap.
**Exploitation:** Flash-loan base token, sell enough to zero the quote reserve, swap the received quote back to extract more base than input, repay loan and keep profit; repeat to drain pool.
**Escalation:** Repeated flash-loan cycles drain the entire pool since each round nets profit.
**Insight:** When AMM math divides by or scales with a reserve, test the boundary where a swap can zero out a reserve; if LP_FEE=0 the reverse swap can be profitable, so check default deployment params for zero fees.