# Permissionless pool seeding price manipulation

Pool or synth created and seeded at attacker-chosen price before guards or oracle apply

_Area: DeFi oracles, liquidations and flash loans. Seen in 3 disclosed reports; latest 2024-09-06. Updated 2026-11-01._

## How it works
A pool, synth or gas-coin market is created and its first price is set by whoever seeds it. The protocol assumes that initial price is either correct or harmless, but nothing enforces it: the seeder picks the ratio, and any mint, launch check or arbitrage that trusts that ratio inherits the attacker's number. The broken assumption is "the first price is a fair price." It is not, because seeding is permissionless or hardcoded, and downstream logic reads spot reserves as if they were truth.

## Where it shows up
- Pool creation callable by anyone with no minimum liquidity, asset allowlist or oracle check [E3](https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-12.md)
- Deploy-time seeding with a fixed nominal ratio (e.g. 0.1/0.1) regardless of real asset value [E2](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-01.md)
- Launch or init functions that assert an AMM spot price (slot0 sqrtPriceX96) equals a cached value [E1](https://bugbountylibrary.com/r/c4%3A2024-06-vultisig%3AH-03.md)
- Mint/synth functions callable against a freshly seeded pool before liquidity or guards exist [E3](https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-12.md)
- Empty or near-empty pools whose spot price is cheap to move by a single swap [E1](https://bugbountylibrary.com/r/c4%3A2024-06-vultisig%3AH-03.md)

## How to review
Find every place a price is read from a pool that the protocol itself just created or seeded. The invariant: no mint, launch, liquidation or settlement may consume a spot price from a pool whose liquidity the caller controls or that was seeded at a caller-chosen or hardcoded ratio. Check that seeding is either gated (allowlist, minimum liquidity, oracle-derived ratio) or that consumers use a manipulation-resistant source. For equality checks on spot price, ask whether the pool can be empty at that moment and whether an attacker can add liquidity that makes the corrective action require a token they cannot obtain [E1](https://bugbountylibrary.com/r/c4%3A2024-06-vultisig%3AH-03.md). Compare hardcoded seed ratios to real asset prices [E2](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-01.md).

## How finders spotted it
- Read launch()'s strict equality check on slot0 sqrtPriceX96 against a cached price, recognized an empty Uniswap V3 pool is trivially manipulable, then reasoned single-sided liquidity above the manipulated price forces corrective swaps to need SALE_TOKEN unavailable before launch [E1](https://bugbountylibrary.com/r/c4%3A2024-06-vultisig%3AH-03.md)
- Read the DeployFungibleCoinZRC20 and SetupChainGasCoinAndPool flow, noticed hardcoded 0.1/0.1 seeding, and verified on-chain that ETH/BTC pool reserves were badly imbalanced [E2](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-01.md)
- Read createPool and mint logic, noticed pool creation is permissionless with first-LP pricing and no minimum liquidity or asset allowlist [E3](https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-12.md)

## Variants seen
- Manipulate empty pool price, then mint single-sided liquidity to block a launch check (DoS) [E1](https://bugbountylibrary.com/r/c4%3A2024-06-vultisig%3AH-03.md)
- Fixed nominal seed ratio creates mispriced reserves, enabling backrun arbitrage [E2](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-01.md)
- Permissionless createPool lets attacker set cheap initial price, then mint synth and drain LPs [E3](https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-12.md)

## Impact and severity
Outcomes ranged from blocking any pool launch (DoS, repeatable and scalable by outscaling admin capital) [E1](https://bugbountylibrary.com/r/c4%3A2024-06-vultisig%3AH-03.md), to guaranteed instant arbitrage profit on every new gas-coin pool [E2](https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-01.md), to cheap synth minting and LP drain [E3](https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-12.md). Impact rises when the attacker controls liquidity size (E1 escalation) or when the mispricing is automatic on every deployment (E2).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2024-06-vultisig%3AH-03.md
- E2: https://bugbountylibrary.com/r/c4%3A2023-11-zetachain%3AM-01.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-12.md