# Liquidation sandwich and frontrun

Predictable loss or rebalance events that outsiders can front-run, exit ahead of, or force to revert

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2025-02-03. Updated 2026-11-01._

## How it works
Some value-moving event has a trigger that outsiders can see coming or steer: a settlement price, a keeper rebalance, a batch liquidation, or a user-callable function that internally trades on an AMM. Because the trigger is predictable or caller-controlled, someone with no stake in the outcome can act first — redeem before losses land, skew a pool so a profit gate reverts, or size a trade around a forced swap. The assumption that breaks is that only the protocol or its honest users decide when and how these events happen. In practice the timing, size, or direction is public or attacker-chosen, so the attacker captures value and the loss is socialized onto passive users.

## Where it shows up
- Loss events with a publicly known trigger (settlement price threshold) combined with unrestricted share redemption [E1](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AH-02.md)
- Keeper/rebalance functions gated on `require(profit > 0)` after an AMM swap [E3](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-08.md)
- User-callable functions that internally do remove-liquidity / swap / add-liquidity on a pool [E4](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-08.md)
- Batch loops that decode one slippage/limit parameter and reuse it for every item [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-20.md)
- Routers or downstream logic that hardcode a 1:1 ratio while the real pool price is movable [E3](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-08.md)

## How to review
For each value-moving event, ask: who controls the timing and size, and is the trigger visible before it fires? The invariant to hold: no party can improve their own exit or entry by acting on information or control available before the event settles, and no single bound is shared across heterogeneous positions.
- Check whether redemption/withdrawal is open while a known loss is pending [E1](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AH-02.md)
- Check whether a profit or threshold gate can be pushed to fail by an outside swap [E3](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-08.md)
- Check whether a user-supplied amount drives an internal AMM sequence, giving the caller the "button" [E4](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-08.md)
- Check that per-position slippage is per-position, not one decoded value [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-20.md)

## How finders spotted it
- Noticed the settlement trigger price is deterministic and LP redemption is unrestricted, then reasoned LPs would rationally exit before known losses; confirmed with a PnL comparison [E1](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AH-02.md)
- Read `_liquidateUser` and saw `minAssetAmount` decoded once and reused across the multi-borrower loop [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-20.md)
- Read `require(profit > 0)` in rebalance and saw the pool price is externally manipulable by front-running [E3](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-08.md)
- Read `bond()` ending in `reLP(_amount)` and realized the user-controlled amount gives indirect control of the UniV2 remove/swap/add sequence without a mempool frontrun [E4](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-08.md)

## Variants seen
- Anticipatory exit: LPs redeem before in-the-money puts settle, socializing loss [E1](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AH-02.md)
- Forced-revert DoS: front-run skews pool so the profit gate fails, keeping protocol depegged [E3](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-08.md)
- Caller-driven sandwich: user-callable bond triggers internal AMM trades at chosen size/time [E4](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-08.md)
- Shared-bound batch flaw: one slippage value under-protects or reverts across positions [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-20.md)

## Impact and severity
Losses are socialized onto passive LPs and can drain collateral enough to DoS bonding and threaten a peg [E1](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AH-02.md). Repeated front-running keeps a protocol depegged while the attacker profits elsewhere [E3](https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-08.md). Sandwiching skims roughly 2.5% of pool TVL per call and compounds with repetition and larger amounts [E4](https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-08.md). Batch reuse either under-protects large positions or reverts the whole batch [E2](https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-20.md). Impact rises with how predictable the trigger is, how openly redemption is allowed, and whether the attacker can repeat or scale the action.

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AH-02.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-20.md
- E3: https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AM-08.md
- E4: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-08.md