# Adjusting "_I_" will create a sandwich opportunity because of price changes

Dodo GSP's adjustPrice instantly changes the pricing curve parameter I, letting a MEV bot sandwich the maintainer's tx and profit at LPs' expense.

- Payout: Contest reward
- Severity: medium
- Program: Dodo Gsp
- Credited: Bandit
- Disclosed: 2023-12-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-dodo-gsp-judging/issues/40
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-dodo-gsp%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:oracle-manipulation

**Target:** GSPVault.adjustPrice / GSPTrader sellBase-sellQuote pricing curve
**Root cause:** adjustPrice changes the curve parameter I immediately in a single tx, instantly shifting the sell price instead of ramping it, so the pending price change is predictable and front-runnable.
**Steps:**
1. LP buys shares: transfer 10 DAI + 10 USDC to gsp, call `buyShares(tapir)`
2. Attacker front-runs: transfer 5 DAI, call `sellBase(tapir)` to sell base before price drops
3. Maintainer tx executes: `gsp.adjustPrice(999000)`
4. Attacker back-runs: transfer received USDC, call `sellQuote(tapir)` to buy base back cheaper
5. Assert `receivedBaseTokens >= initialBaseTokensSwapped` — attacker ends with more DAI than started
**How found:** Reading docs showing I directly determines trader output amount, then reasoning that any single-tx parameter change affecting price is front-runnable; confirmed with a Foundry sandwich PoC.
**Exploitation:** MEV bot observes pending adjustPrice, sells base just before the parameter change and rebuys after, capturing the price delta; profit equals LP loss.
**Insight:** Any privileged setter that instantly moves a pricing-curve parameter (I, amplification, fee) is a sandwich target — check whether the protocol ramps parameters over time like Curve/yETH instead of applying them atomically.