# Attacker can steal LPs funds by using different oracle prices in the same transaction

LP announces withdrawal and deposit, then executes both with two different Pyth prices in one transaction to skim value from traders.

- Payout: Contest reward
- Severity: medium
- Program: Flat Money Fix Review Contest
- Credited: bareli
- Disclosed: 2024-03-29
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-flat-money-fix-review-contest-judging/issues/27
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-flat-money-fix-review-contest%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm technique:chained technique:incomplete-fix vuln:business-logic vuln:oracle-manipulation

**Target:** OracleModule.sol Pyth price feed integration
**Root cause:** Pyth oracle can return different prices within the same transaction; withdrawal and deposit paths each accept a caller-supplied price, so the same txn can settle the withdrawal at a higher price and the deposit at a lower one.
**Steps:**
1. Deposit liquidity as LP at address A.
2. Announce withdrawal of all liquidity from A.
3. In same txn announce deposit of same amount from address B.
4. Wait minimum execution time.
5. Fetch two Pyth prices where second < first.
6. Execute withdrawal for A with the higher price.
7. Execute deposit for B with the lower price.
**How found:** Prior audit issue #216 showed Pyth returns different prices in one txn; researcher re-examined the fix and found the LP withdraw/deposit path still accepts two distinct prices in the same transaction.
**Exploitation:** Attacker keeps same LP position but gains the price deviation as profit; if sole LP, no withdrawal fee, so profit is taken from traders.
**Escalation:** Same primitive also applies to leverage open/close and limit orders (announce open, execute at lower price; announce close, execute at higher price).
**Insight:** When a protocol 'fixes' an oracle-manipulation report, re-check every other code path that consumes the same oracle price argument — the fix often only closes the originally reported path while sibling flows still accept caller-chosen prices.