Submitted by shaflow2, also found by 0xD4n13l, 0xGondar, c0pp3rscr3w3r, Coldless, EPSec, Evo, farismaulana, Fitro, Fon, Infect3d, jaraxxus, Jiri123, jkk812812, kodyvim, Le_Rems, m4k2, macart224, MrPotatoMagic, Mushow, NexusAudits, NexusAudits, parishill24, pontifex, prapandey031, rouhsamad, rspadi, threadmodeling, Tychai0s, typicalHuman, Vasquez, zxriptor, and zzebra83
When launching a new pool, the factory contract needs to call the takeLoan function to intervene with virtual liquidity. The amount that can be borrowed is limited to 300 ether per block. 
github: https://github.com/code-423n4/2024-12-lambowin/blob/874fafc7b27042c59bdd765073f5e412a3b79192/src/VirtualToken.sol#L93 
However, when launching a new pool, the amount of virtual liquidity is controlled by users, and the minimum cost to launch a new pool is very low, requiring only gas fees and a small buy-in fee. This allows attackers to launch malicious new pools in each block, consuming the borrowing limit, which prevents legitimate users from launching new pools.
Running the above test can prove that an attacker only needs to consume the gas fee + 10 wei to exhaust the entire blocks virtual liquidity available for creating new pools.
Shaneson (Lambo.win) acknowledged
