# LP Tokens always valued at 3 PTs

Napier AMM hardcodes Curve Base LP token value at 3 PTs, ignoring rising virtual price, letting arbitrageurs drain value from pool LPs.

- Payout: Contest reward
- Severity: high
- Program: Napier
- Credited: xiaoming90
- Disclosed: 2024-01-24
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-01-napier-judging/issues/90
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Napier AMM pool / PoolMath swap math
**Root cause:** PoolMath and NapierPool multiply Base LP token amounts by constant N_COINS=3, assuming LP token always equals 3 PTs, but Curve LP virtual price grows over time via fees.
**Steps:**
1. Observe PoolMath.swapExactBaseLpTokenForUnderlying multiplies exactBaseLptIn by N_COINS=3 (`exactBaseLptIn.neg() * N_COINS`)
2. Observe swapUnderlyingForExactBaseLpToken similarly multiplies exactBaseLptOut by N_COINS
3. Note Curve LP virtual price (D/totalSupply) increases over time as fees accrue
4. Acquire LP tokens from Napier AMM at the static 3-PT valuation
5. Redeem LP tokens in Curve at the higher actual virtual price, pocketing the difference
**How found:** Code review of PoolMath and NapierPool swap functions; noticed hardcoded N_COINS=3 multiplier and reasoned that Curve LP virtual price grows over time, making the static assumption stale.
**Exploitation:** Arbitrageur buys LP tokens from Napier AMM priced at 3 PTs each, then redeems them in Curve at their true (higher) virtual price, capturing the spread at the expense of Napier pool LPs.
**Insight:** When an AMM hardcodes a conversion factor for a yield-bearing/rebasing token (LP, SY, aToken), compare against the token's live virtual price/exchange rate; any static multiplier becomes an arbitrage surface as the rate drifts.