Submitted by TomFrenchBlockchain, also found by pauliax and robee
Frontrunners can extract up to 100% of the value provided by LPs to VaderPoolV2 as fungible liquidity.
Users can provide liquidity to VaderPoolV2 through the mintFungible function.
https://github.com/code-423n4/2021-12-vader/blob/fd2787013608438beae361ce1bb6d9ffba466c45/contracts/dex-v2/pool/VaderPoolV2.sol#L311-L317
This allows users to provide tokens in any ratio and the pool will calculate what fraction of the value in the pool this makes up and mint the corresponding amount of liquidity units as an ERC20.
However theres no way for users to specify the minimum number of liquidity units they will accept. As the number of liquidity units minted is calculated from the current reserves, this allows frontrunners to manipulate the pools reserves in such a way that the LP receives fewer liquidity units than they should. e.g. LP provides a lot of nativeAsset but very little foreignAsset, the frontrunner can then sell a lot of nativeAsset to the pool to devalue it.
Once this is done the attacker returns the pools reserves back to normal and pockets a fraction of the value which the LP meant to provide as liquidity.
Add a user-specified minimum amount of LP tokens to mint.
SamSteinGG (Vader) acknowledged
Jack the Pug (judge) decreased severity to medium and commented:
