# Donating (and syncing) tokens to an Aerodrome allows to bypass exposure limits

Attacker donates tokens to a self-owned Aerodrome pool and calls sync() to inflate LP collateral value, bypassing Arcadia creditor exposure limits.

- Payout: Contest reward
- Severity: medium
- Program: Arcadia Pricing Module
- Credited: zzykxx
- Disclosed: 2024-04-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-arcadia-pricing-module-judging/issues/17
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-arcadia-pricing-module%3AM-1
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:evm technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** Aerodrome LP collateral pricing in Arcadia accounts
**Root cause:** Arcadia prices Aerodrome LP collateral from pool reserves, which can be arbitrarily inflated by direct token transfers plus sync(); donated value is counted fully without capping.
**Steps:**
1. Create a new Aerodrome pool (e.g. STG/WETH) and provide ~$1000 liquidity, minting LPs
2. Deposit the LP into an Arcadia account as collateral worth ~$1000
3. Transfer ~$500,000 of STG and WETH directly to the Aerodrome pool address
4. Call `sync()` on the pool to update reserves
5. Collateral now valued ~$501,000, bypassing exposure limits
**How found:** Code reading of how Arcadia prices Aerodrome LP collateral from pool reserves, combined with knowledge that Aerodrome's sync() adopts direct token transfers as reserves.
**Exploitation:** Attacker owns ~100% of pool liquidity, so donated tokens are recoverable; inflated reserves raise the LP's priced value, letting them exceed creditor exposure limits without real capital loss.
**Insight:** When a protocol prices LP/AMM collateral from pool reserves, check whether reserves can be inflated by direct transfers plus sync()/skim on pools the attacker fully controls.