# Legitimate pools can be taken over and the penalty is not fair.

GoatV1Pair.takeOverPool lacks a virtual-Ether check, letting an attacker take over a legitimate pool cheaply while the original LP pays a 5% penalty.

- Payout: Contest reward
- Severity: medium
- Program: Goat Trading
- Credited: kennedy1030
- Disclosed: 2024-03-10
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-goat-trading-judging/issues/46
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-goat-trading%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** GoatV1Pair.takeOverPool() in GoatV1Pair.sol
**Root cause:** takeOverPool only enforces a 10% token increase (L481/L496) but never checks that the new virtualEth/bootstrapEth is not higher than the old, contrary to the documented 'lower but not higher' rule.
**Steps:**
1. Identify a legitimate pool with an initial LP and no vesting (_vestingUntil == _MAX_UINT32).
2. Call `takeOverPool(initParams)` with a large `initParams.virtualEth`/`bootstrapEth` so the required token amount is inflated but the attacker's cost is offset.
3. Satisfy the 10% token check at L481 and the tokenAmountIn check at L496 by transferring tokens.
4. Attacker's LP is minted and the original LP is burned; `_handleTakeoverTransfers` applies the 5% penalty to the original liquidity provider.
**How found:** Code review comparing the documented rule ('lower virtual Ether, not higher') against the implementation, noticing L481/L496 only validate token amounts and never virtualEth/bootstrapEth.
**Exploitation:** Attacker calls takeOverPool with inflated virtualEth to seize the pool; original LP's balance is burned and penalized 5%, while attacker pays only ~10% extra tokens and recovers cost via the raised virtual Ether.
**Insight:** When a function's docstring states a directional constraint (can lower, not raise), grep the implementation for that exact variable—missing directional checks on config params are a recurring takeover vector in pool/ownership-transfer logic.