# LP collateral self-inflated valuation

LP/pool token priced from fees, virtual price, or supply the borrower can move or self-generate

_Area: DeFi oracles, liquidations and flash loans. Seen in 2 disclosed reports; latest 2024-04-15. Updated 2026-10-24._

## How it works
Collateral value for an LP or pool token is derived from a quantity the borrower can influence: accrued fees, a virtual price, or a supply figure. The protocol assumes that quantity reflects genuine external value, but the depositor can move it after depositing (or before), so the collateral is worth less than the price the system assigns. The broken assumption is that the valuation input is independent of the borrower's actions.

## Where it shows up
- Collateral math that adds `feesOf(positionId)` or accrued fee0/fee1 to underlying amounts [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-arcadia-pricing-module%3AM-2.md)
- Hardcoded conversion factors for yield-bearing or rebasing tokens (LP, SY, aToken) instead of live exchange rate [E1](https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AH-3.md)
- Share math using `totalSupply()` where the pool exposes `getActualSupply()` [E3](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-6.md)
- Wrappers where the depositor can be the sole LP or control pool liquidity [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-arcadia-pricing-module%3AM-2.md)
- Static multipliers like `N_COINS` applied to LP token amounts [E1](https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AH-3.md)

## How to review
For every collateral valuation, list each input and ask: can the depositor change this after depositing? The invariant: collateral value must be computed only from quantities the borrower cannot self-generate or move. Check that fees counted as value cannot be produced by self-swapping in an owned pool [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-arcadia-pricing-module%3AM-2.md); that conversion factors track the token's live virtual price/exchange rate rather than a constant [E1](https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AH-3.md); and that supply figures use the actual circulating supply, not a max/initial value [E3](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-6.md). Compare the formula against a live pool where the metric differs from the assumed one.

## Variants seen
- Static multiplier for a yield-bearing LP token whose virtual price grows over time [E1](https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AH-3.md)
- Accrued fees counted as collateral, self-generated by swapping in an owned pool [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-arcadia-pricing-module%3AM-2.md)
- Wrong supply metric (`totalSupply()` vs `getActualSupply()`) mispricing LP [E3](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-6.md)

## Impact and severity
E1 let arbitrageurs drain value from pool LPs; E2 bypassed exposure limits and inflated collateral; E3 grossly mispriced POL and caused incorrect RBS deployment. Severity is high where the inflated value feeds borrowing or limit checks, since the borrower can extract more than their real collateral. Worse when the attacker controls the pool or is the only LP [E2](https://bugbountylibrary.com/r/sherlock%3A2024-04-arcadia-pricing-module%3AM-2.md), or when the stale factor is baked into swap math [E1](https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AH-3.md).

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-01-napier%3AH-3.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-04-arcadia-pricing-module%3AM-2.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AM-6.md