# LP share spot-price manipulation

LP value read from live reserves, slot0 or virtual price, letting one swap misprice mint, borrow or liquidation

_Area: DeFi oracles, liquidations and flash loans. Seen in 24 disclosed reports; latest 2026-08-31. Updated 2026-10-23._

## How it works
An LP token's value is computed from the pool's *current* state: reserves, slot0 tick, or a claim ratio divided by current liquidity. That state is a function of the last trade, so a single large swap (often flash-loan funded) moves the computed LP price away from fair value. Any deposit, withdraw, borrow, or liquidation priced off that number is mispriced, and the attacker reverses the swap after capturing the difference [E1](https://bugbountylibrary.com/r/dhl%3A20260831-floatprotocol.md)[E2](https://bugbountylibrary.com/r/dhl%3A20250426-impermaxv3.md)[E4](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AH-04.md)[E6](https://bugbountylibrary.com/r/dhl%3A20241002-lavalending.md). The broken assumption is that pool state at read time reflects durable value; it only reflects the caller's own trade.

## Where it shows up
- LP price = reserves × external price / totalSupply, reserves read from spot [E4](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AH-04.md)[E5](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-27.md)
- Uniswap V3 slot0 used in getTotalAmounts() with no TWAP or deviation guard on permissionless deposit/withdraw [E1](https://bugbountylibrary.com/r/dhl%3A20260831-floatprotocol.md)[E7](https://bugbountylibrary.com/r/dhl%3A20240104-gamma.md)
- LP collateral valued from spot reserves in a lending market [E2](https://bugbountylibrary.com/r/dhl%3A20250426-impermaxv3.md)[E6](https://bugbountylibrary.com/r/dhl%3A20241002-lavalending.md)
- Claim amounts divided by current market reserves even when the asset price itself is TWAP'd [E3](https://bugbountylibrary.com/r/c4%3A2021-08-notional%3AH-10.md)
- Price feed returning aggregate position value instead of per-share value [E8](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AH-4.md)

## How to review
The invariant: the LP price used for minting, borrowing, or liquidation must not move materially within one transaction in response to a swap the caller controls. Check that reserves come from a manipulation-resistant source: a TWAP whose observation window a single-block skew cannot dominate, with an explicit staleness bound, or a fair reserve ratio derived from a time-weighted or external reference price. Confirm deposit/withdraw have a deviation guard with a concrete threshold (e.g. reject if spot deviates >1-2% from TWAP). For collateral, confirm an inflated LP price cannot produce an undercollateralized loan [E6](https://bugbountylibrary.com/r/dhl%3A20241002-lavalending.md). Note that even a correct external oracle fails when the attacker owns the pool's arbitrage path and can hold reserves skewed [E5](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-27.md). Separately, verify the feed is normalized per share (divides by total supply) [E8](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AH-4.md).

## Variants seen
- Uniswap V3 Hypervisor slot0 spot pricing on deposit/withdraw [E1](https://bugbountylibrary.com/r/dhl%3A20260831-floatprotocol.md)[E7](https://bugbountylibrary.com/r/dhl%3A20240104-gamma.md)
- Uniswap V3 LP position as spot-priced collateral [E2](https://bugbountylibrary.com/r/dhl%3A20250426-impermaxv3.md)
- Reserve-dependent claim ratios reintroducing spot manipulation into a TWAP-based valuation [E3](https://bugbountylibrary.com/r/c4%3A2021-08-notional%3AH-10.md)
- DODO reserve-based aggregator inflating a stable pair [E4](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AH-04.md)
- Spot reserves inflating LP collateral for borrowing [E5](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-27.md)[E6](https://bugbountylibrary.com/r/dhl%3A20241002-lavalending.md)
- Aggregate position value returned instead of per-share price [E8](https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AH-4.md)

## Impact and severity
Direct extraction (E1 ~10.7 ETH, E7 ~$6.3M), bad-debt loans [E5](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-27.md)[E6](https://bugbountylibrary.com/r/dhl%3A20241002-lavalending.md), and mispriced collateral [E2](https://bugbountylibrary.com/r/dhl%3A20250426-impermaxv3.md)[E4](https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AH-04.md). Severity rises when the mispricing gates borrowing or permissionless deposit/withdraw, when flash loans remove capital constraints, and when the attacker controls the pool's arbitrage path [E5](https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-27.md).

## Evidence
- E1: https://bugbountylibrary.com/r/dhl%3A20260831-floatprotocol.md
- E2: https://bugbountylibrary.com/r/dhl%3A20250426-impermaxv3.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-08-notional%3AH-10.md
- E4: https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AH-04.md
- E5: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-27.md
- E6: https://bugbountylibrary.com/r/dhl%3A20241002-lavalending.md
- E7: https://bugbountylibrary.com/r/dhl%3A20240104-gamma.md
- E8: https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AH-4.md