# Utilization rate for bonding curve purposes is calculated for a total of bull and bear usage, which can be abused to steal all vault funds

Smilee's bonding-curve volatility uses combined bull+bear utilization, letting a trader buy the pricier option, inflate volatility via the cheap side, and sell at a profit, draining the vault.

- Payout: Contest reward
- Severity: high
- Program: Smilee Finance
- Credited: panprog
- Disclosed: 2024-02-01
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2024-02-smilee-finance-judging/issues/99
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-smilee-finance%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** IG options trading / bonding-curve volatility pricing
**Root cause:** Utilization rate feeding the bonding curve is computed from total bull+bear notional, but bull and bear premiums differ asymmetrically, so buying the cheap side inflates volatility and the price of the expensive side disproportionately.
**Steps:**
1. Set strike=1, price=1.2, weekly expiry, vault liquidity 1 bull + 1 bear.
2. Buy 0.5 IG Bull (premium ~0.05058), raising utilization to ~25%.
3. Buy 1 IG Bear (premium ~0.0001), raising utilization to ~75% cheaply.
4. Sell 0.5 IG Bull at inflated volatility (receive ~0.05139).
5. Sell 1 IG Bear at reduced volatility (receive ~0.000003).
6. Net profit ~0.0008 per cycle; repeat ~1500 times to drain vault.
**How found:** Code review of Notional.utilizationRateFactors and IG.getUtilizationRate revealed utilization aggregates bull+bear, then reasoning about asymmetric premiums when spot is away from strike led to the pump-and-dump volatility hypothesis, confirmed with a Foundry PoC.
**Exploitation:** Attacker repeatedly buys the higher-priced option, buys the lower-priced option to pump utilization/volatility, then sells the higher-priced option at the inflated premium and the lower-priced one at a smaller loss, extracting the absolute-value difference from the vault each cycle.
**Escalation:** Looping the 4-trade sequence ~1500 times drains essentially all vault funds.
**Insight:** When a pricing curve keys off a shared utilization metric across two asymmetric instruments, check whether trading the cheap instrument can move the price of the expensive one more than the cost of the cheap trade.