# OCL_ZVE.sol::forwardYield relies on manipulable Uniswap V2 pool reserves leading to theft of funds

OCL_ZVE.forwardYield reads manipulable Uniswap V2 reserves, letting an attacker flashloan-skew the pool to shrink basis and later drain principal as yield.

- Payout: Contest reward
- Severity: medium
- Program: Zivoe
- Credited: 0xpiken
- Disclosed: 2024-03-19
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-zivoe-judging/issues/296
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-zivoe%3AM-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:flash-loan vuln:oracle-manipulation

**Target:** OCL_ZVE.sol yield-forwarding locker using Uniswap V2 ZVE/pairAsset pool
**Root cause:** fetchBasis derives claimable pairAsset from live Uniswap V2 pool reserves, which are flashloan-manipulable; forwardYield then persists the manipulated low amount as the new basis.
**Steps:**
1. Attacker flashloans and buys large amount of USDC in the ZVE/pairAsset Uniswap V2 pool, skewing reserves
2. Call `OCL_ZVE.forwardYield()`; `fetchBasis()` returns a tiny `amount`; since `amount <= basis`, no yield forwarded and `(basis,) = fetchBasis()` stores the tiny value
3. Sell back the large buy to unwind the pool manipulation
4. ~30 days later call `forwardYield()` again; with basis now tiny, nearly the entire principal is forwarded as 'yield' to tranches/residual recipients
**How found:** Code review of forwardYield/fetchBasis noticing basis is set from spot Uniswap V2 reserves, which are spot-manipulable; reasoned that a low manipulated amount persists as basis and inflates the next distribution.
**Exploitation:** Flashloan-funded reserve skew around a forwardYield call to reset basis low, then a later unmanipulated forwardYield distributes inflated yield, siphoning locker principal.
**Insight:** When a contract persists a value derived from AMM spot reserves (basis, TWAP-less price, share value) as state, a single skewed read can poison future accounting; check whether the stored value is later used to release funds.