# Swapping large amounts of assets back and forth in an Aerodrome pool allows to bypass exposure limits

Aerodrome LP wrapper counts accrued trading fees in collateral value, so self-swapping in an owned pool inflates collateral and bypasses exposure limits.

- Payout: Contest reward
- Severity: medium
- Program: Arcadia Pricing Module
- Credited: PUSH0
- Disclosed: 2024-04-15
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-04-arcadia-pricing-module-judging/issues/18
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-04-arcadia-pricing-module%3AM-2
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** WrappedAerodromeAM collateral valuation (Aerodrome LP wrapper)
**Root cause:** The wrapper values collateral as amountWrapped plus accumulated fee0/fee1 from feesOf(positionId); fees are counted as value even though they can be self-generated by the depositor.
**Steps:**
1. Create a new Aerodrome pool and mint LPs so attacker owns ~all liquidity supply
2. Deposit the LP as collateral via `WrappedAerodromeAM`
3. Repeatedly swap large amounts back and forth in the pool to accrue fees on the position
4. `feesOf(positionId)` grows, inflating `underlyingAssetsAmounts[1]/[2]` and thus collateral value while already deposited
5. Repeat indefinitely to exceed exposure limits, losing only gas
**How found:** Code reading of the collateral valuation in WrappedAerodromeAM: noticed feesOf(positionId) is added to underlying asset amounts, and realized the depositor can generate those fees themselves by controlling pool liquidity.
**Exploitation:** Attacker controls the pool's liquidity, so swap fees paid come back to them; the wrapper still credits those fees as collateral value, letting them inflate deposited collateral past exposure limits at gas cost only.
**Insight:** When a wrapper prices collateral including accrued fees/rebates, check whether the depositor can self-generate those fees (own the pool, be the only LP) so valuation is attacker-controllable post-deposit; compare to UniswapV3 guards.