# ArrakisMetaVaultPrivate::fund No slippage control on private vault deposit can cause unlimited loss to owner

Private vault deposit lacks slippage control, letting an attacker front-run to skew pool price and backrun for profit at depositor's expense.

- Payout: Contest reward
- Severity: high
- Program: Arrakis
- Credited: cergyk
- Disclosed: 2024-03-02
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-03-arrakis-judging/issues/80
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:oracle-manipulation

**Target:** ArrakisMetaVaultPrivate::fund / ValantisHOTModulePrivate depositLiquidity
**Root cause:** fund() deposits liquidity without exposing expected sqrt spot price bounds (_expectedSqrtSpotPriceLowerX96/UpperX96), so deposits execute at whatever manipulated price exists; oracle checks are skipped in AMM-only mode with no feeds.
**Steps:**
1. Pool: DAI/USDC 1:1, bounds [0.5,1.5], reserves 1000:1000, price 1.
2. Bob submits deposit of 1000 USDC : 1000 DAI.
3. Alice front-runs, swaps 1366 USDC for 975 DAI, pushing price to 0.51 (reserves 2366 USDC : 25 DAI).
4. Bob's deposit executes at skewed price, adding liquidity unbalanced (reserves 3366 USDC : 1025 DAI).
5. Alice back-runs, swaps 1647 DAI for 2307 USDC, netting ~269 USDC profit.
**How found:** Reviewer noted private vault shares aren't explicitly minted so no min-shares slippage check is possible, then reasoned that deposit price itself is unprotected and constructed a Uniswap v3 liquidity math PoC to quantify the sandwich profit.
**Exploitation:** Attacker observes pending private vault deposit, sandwiches it: front-run swap to move spot price to edge of range, let deposit add liquidity at unfavorable price, then back-run swap to capture the imbalance profit.
**Insight:** When a deposit mints no explicit shares (owner holds all), slippage can't be bounded by min-shares—look instead at whether the underlying addLiquidity accepts price-deviation bounds, and check if oracle guards are bypassable in alternate modes (e.g. AMM-only with no feeds).