PancakeSwap Vulnerability – Addressing Unlocked Wallet Holding 100% of LP

liquidity-providerpancakeswapvulnerability

I'm in https://poocoin.app/ to follow some charts of a meme token and found this message in red "An unlocked wallet is holding 100% of LP".

By following the link I ended in a PancakeSwap LP page of that pair with just 2 holders.

Is this token somehow vulnerable to any exploit until the owner lock it (whatever this means) ?

Best Answer

It means the owner can rug pull(remove liquidity, steal everyone's investment, and make the token valueless) any time. That is why that prompt exists. Locks are commonly done on DxSale and Poocoin checks if the LP holder is a DxSale/unicrypt/something else contract.

Related Solutions

Uniswap – Does Each Token-Pair Produce Its Own LP Token in DEFI?

Uniswap is an automated liquidity protocol powered by a constant product formula and implemented in a system of non-upgradeable smart contracts on the Ethereum blockchain. [...] Each Uniswap smart contract, or pair, manages a liquidity pool made up of reserves of two ERC-20 tokens. Anyone can become a liquidity provider (LP) for a pool by depositing an equivalent value of each underlying token in return for pool tokens. These tokens track pro-rata LP shares of the total reserves, and can be redeemed for the underlying assets at any time.

https://uniswap.org/docs/v2/protocol-overview/how-uniswap-works/

In brief: your LP tokens are "shares" of a particular LP. Therefore each LP (or token pair) produces its own LP token.

Uniswap V3 – How to Create LP (ETH-ERC20 Pair) Using Solidity

I'm assuming you refer to the official Uniswap V3 example here : https://docs.uniswap.org/sdk/guides/liquidity/adding and that your pool is initialized

Short answer: Uniswap handles the (un)wrapping.

Complete answer :

The main idea in adding liquidity is similar to how swaps are performed in V3:

start from a periphery (optional) "helper" (NonfungiblePositionManager.sol here), which is inheriting LiquidityManagement.sol (from periphery/base). This is where you can find the (internal) addLiquidity function which, after computing the amount (price for start and end tick and Struct packing) will...
...call the low-level-ish mint function on the pool itself. This function is quite short, and can be summarized as: take note of the current pool balances - call the callback - take note and comparing the new pool balances.

The actual token transfers are done in the callback, which must be implemented by the contract calling pool.mint (here, LiquidityManagement does it for you). The callback uses pay() (from base/peripheryPayment), where you can easily see the (un)wrapping mechanism (pay is used by the swap callback too).

if (token == WETH9 && address(this).balance >= value) {
        // pay with WETH9
        IWETH9(WETH9).deposit{value: value}(); // wrap only what is needed to pay
        IWETH9(WETH9).transfer(recipient, value);

Control schema:

 Periphery                Core
addLiquidity      --->  pool.mint
mintCallback&Pay  <---  
                  --->  pool.mint

Best Answer

Related Solutions

Uniswap – Does Each Token-Pair Produce Its Own LP Token in DEFI?

Uniswap V3 – How to Create LP (ETH-ERC20 Pair) Using Solidity

Related Topic