Cowrie Research

impermax-v3-uncollected-fee-collateral-overvaluation-self-liquidation-drain-2025-04-26

13 min read

Impermax V3 Uncollected-Fee Collateral Overvaluation / Self-Liquidation Drain (2025-04-26)

  • Name: Impermax V3 uncollected-fee collateral overvaluation / self-liquidation drain
  • Date: 2025-04-26
  • Protocol: Impermax V3
  • Chain: Base
  • Category: concentrated-liquidity collateral valuation mismatch / uncollected-fee overvaluation / self-liquidation monetization / bad-debt socialization
  • Loss: about $300K immediately stolen, with Impermax saying another $300K-$350K remained at risk if borrowers repaid and later estimating the final loss would likely be around $400K
  • Summary: Impermax V3 let borrowers post Uniswap V3 LP positions as collateral, including pending uncollected fees. The attacker used a flash loan, a low-liquidity WETH/USDC 1% pool on Base, and roughly 50 self-directed swaps to build a position whose apparent collateral value sat mostly in uncollected fees on one side of an extreme tick. Impermax then let that position borrow against those pending fees as if they would convert cleanly into durable liquidity. When the attacker called reinvest, the protocol auto-compounded those fees at the wrong tick and under the wrong ratio assumptions, so the position’s real value collapsed once price returned toward the live market. The attacker then called restructureBadDebt, pushing the loss into lenders while keeping the borrowed assets and repeating the cycle until available liquidity was drained.
  • Trigger / entry point:
    • The vulnerable surface was Impermax V3’s collateral valuation and bad-debt handling for concentrated-liquidity positions, specifically the mismatch between how it valued uncollected fees before borrowing and how those same fees behaved once auto-compounded with reinvest.
    • Impermax’s own postmortem says the root cause was “a discrepancy in a valuation between uncollected and auto compounded fees used as collateral,” specifically that the auto-compounded form became subject to ratio change based on safetyMargin while the pre-borrow uncollected-fee mark was still treated more generously.
    • The attacker only needed a sufficiently thin Uniswap V3 pool where they could become the dominant active-liquidity provider, distort the tick, manufacture large pending fees, then borrow before those fees were transformed into their much weaker reinvested form.
  • Root cause:
    • Impermax treated pending Uniswap V3 fees as collateral value close enough to principal liquidity for borrowing purposes, but those pending fees did not preserve the same value once converted into live liquidity through the protocol’s reinvest path.
    • The gap mattered most in edge states where the position had been pushed far out of balance: the accrued fees sat mostly on one side, while the later auto-compound step re-entered liquidity at a tick and ratio shaped by Impermax’s safetyMargin assumptions rather than by a hostile unwind model, exposing the position to severe impermanent-loss-style collapse as soon as price normalized.
    • The protocol therefore had two incompatible truths for the same collateral object: one generous truth before borrow, and one much harsher truth after compounding and price normalization.
    • restructureBadDebt then turned that manufactured insolvency into a lender-loss socialization path instead of forcing the attacker to eat the collapse themselves.
  • Exploit path:
    1. The attacker EOA 0xE3223f7E3343c2C8079f261D59ee1e513086C7C3 used attack contract 0x98E938899902217465f17CF0B76d12B3DCa8CE1b on Base, with Impermax and third-party analyses highlighting exploit transaction 0xad4fc3156666d5402f00dcfd5c183493d283f4166a6dd581dd8c0a895e826a56 and related attack loops such as 0x14ea5b572a01234c9499174ada90d6a20af016749458297a8b071d8271f3ed77 and 0xde903046b5cdf27a5391b771f41e645e9cc670b649f7b87b1524fc4076f45983.
    2. Using flash-loaned capital, the attacker opened an Impermax V3 collateral position tied to a thin Uniswap V3 WETH/USDC pool on Base.
    3. They pushed the pool tick to an extreme price so the position became badly out of balance in real economic terms.
    4. While dominating the active liquidity, they executed about 50 swaps to accumulate large uncollected fees on their position, with most of the apparent collateral value now sitting in pending fees rather than in durable underlying liquidity.
    5. Impermax let the attacker borrow against that position, counting both the principal liquidity and the inflated pending-fee component as collateral.
    6. The attacker then called reinvest, which auto-compounded the uncollected fees into the existing position but at the wrong tick / ratio assumptions for the now-manipulated state.
    7. After moving price back toward the live market tick, the newly compounded position was worth far less than the collateral valuation Impermax had just honored; the position was now deeply underwater while the borrowed assets were already out.
    8. The attacker called restructureBadDebt, closing or rewriting the bad debt in a way that diluted lenders instead of clawing back value from the attacker.
    9. By repeating the loop, the attacker could steal current available liquidity immediately and also sit in front of future lender liquidity that reappeared when honest borrowers repaid.
  • What the attacker needed to be true:
    • Impermax had to accept pending, uncollected Uniswap V3 fees as borrow-supporting collateral value.
    • The targeted Uniswap V3 pool had to be thin enough that the attacker could dominate current active liquidity and manufacture fee inventory through repeated swaps.
    • The protocol had to let borrowing happen before reinvest forced those fees into their weaker compounded form.
    • The protocol needed a bad-debt resolution path like restructureBadDebt that let the attacker finalize the position’s collapse while externalizing the loss to lenders.
  • Technical anatomy worth remembering:
    • This was not a plain spot oracle manipulation incident. The sharper mistake was that Impermax treated one state of a concentrated-liquidity position — pending fee receivables — as if it were economically interchangeable with the auto-compounded liquidity those fees would later become.
    • The attack depended on concentrated-liquidity microstructure. The attacker first moved the tick far enough that the position’s economics became one-sided, then generated fee inventory exactly in that distorted state.
    • The attacker did not need the reinvest step to be broken in a generic sense; they needed it to be faithful to the wrong state. Auto-compounding at the manipulated tick converted apparently rich fee collateral into much poorer live liquidity.
    • restructureBadDebt mattered as much as the collateral overvaluation. Without a clean way to push the resulting insolvency onto lenders, the trade would have been far less attractive.
    • Impermax’s own emergency warning to borrowers — do not repay or close positions yet — is part of the mechanics worth preserving. It shows the attacker had not only drained present liquidity but had also positioned themselves to capture liquidity that later became available.
  • Representative transactions and artifacts:
    • Attacker EOA: 0xE3223f7E3343c2C8079f261D59ee1e513086C7C3
    • Attack contract: 0x98E938899902217465f17CF0B76d12B3DCa8CE1b
    • Profit-routing address highlighted by QuillAudits: 0xE9f853d2616ac6b04E5fC2B4Be6EB654b9F224Cd
    • Example exploit transaction from Impermax postmortem: 0xad4fc3156666d5402f00dcfd5c183493d283f4166a6dd581dd8c0a895e826a56
    • Example related exploit transactions highlighted in public analysis: 0x14ea5b572a01234c9499174ada90d6a20af016749458297a8b071d8271f3ed77, 0xde903046b5cdf27a5391b771f41e645e9cc670b649f7b87b1524fc4076f45983
  • Response / mitigation:
    • Impermax publicly warned borrowers not to reduce or close positions until remediation, because repaid liquidity would otherwise become fresh attacker-accessible capital.
    • The team said lenders would be reimbursed based on a snapshot taken before the hack, though the timing and proportion were initially unclear.
    • The design lessons are straightforward even if the code path was subtle: do not let pending fee receivables count as full-strength collateral without modeling how they convert into executable liquidity; do not let a borrower trigger the exact state transition that reveals the collateral was weaker than advertised; and do not make bad-debt restructuring itself an attacker-owned payout rail.

Pattern tags

Why the exploit worked

  • Impermax treated pending Uniswap V3 fees as borrow-supporting collateral close to settled liquidity even though those fees only became executable value through a much weaker later reinvest path.
  • The attacker authored the fee inventory in a thin pool they could dominate, so the protocol was effectively lending against an adversary-shaped fee state rather than against independent market depth.
  • reinvest exposed the mismatch by converting those one-sided pending fees into live liquidity under manipulated tick and ratio conditions, collapsing the position’s real unwind value after borrowing had already occurred.
  • restructureBadDebt then finished the monetization path by letting the attacker lock the shortfall into lender-socialized loss instead of forcing the borrower to realize the collapse themselves.

Detection and audit pivots

  • Compare pre-borrow pending-fee valuation against post-reinvest executable unwind value under hostile ticks, one-sided inventory, and price normalization. If those states diverge sharply, the protocol is lending against presentation value rather than liquidation value.
  • Replay the full borrower-owned sequence in thin pools: manufacture fees -> borrow -> reinvest -> normalize price -> trigger bad-debt handling. If one actor can complete that loop before an independent liquidator or haircut intervenes, the collateral model is underdesigned.
  • Treat pending fees, active liquidity, and bad-debt resolution as one solvency object. If borrowing honors the strongest version of the collateral while cleanup settles against the weakest version, the gap is unsecured credit.
  • Ask whether restructureBadDebt, deleveraging, or other cleanup verbs can finalize borrower-authored insolvency. Loss-socialization tools that preserve attacker upside belong in the exploit path review, not only in post-incident operations.

Why this incident matters

  • Impermax preserves a useful 2025 concentrated-liquidity lending lesson that is neither ordinary oracle manipulation nor ordinary AMM math failure.
  • It shows how LP-collateral protocols can break even when they read their own valuations correctly according to local rules: if pending fees, reinvested liquidity, and post-normalization value are treated as interchangeable, the protocol can lend against value that disappears the moment it becomes real.
  • It is also a clean self-liquidation-monetization cousin where the attacker did not merely escape with an undercollateralized borrow; they used the protocol’s own bad-debt handling to lock lender dilution in place.

Failure-prevention checklist

  • Mark pending Uniswap V3 fees as a weaker collateral object than already-placed liquidity unless the protocol can prove a conservative, executable conversion into live inventory under hostile ticks and hostile unwind conditions.
  • Value LP collateral against weakest-leg unwind value, not against a presentation mark that assumes pending fees will compound into balanced liquidity without slippage, range skew, or impermanent-loss collapse.
  • Prevent same-window sequences where a borrower can 1) manufacture pending-fee inventory, 2) borrow against it, 3) trigger reinvest, and 4) push the resulting insolvency into restructureBadDebt before independent liquidation or re-marking occurs.
  • Quarantine or heavily haircut collateral states produced in thin pools where one actor can dominate active liquidity and self-manufacture the fee history later treated as borrow-supporting value.
  • Treat reinvest as a solvency-changing state transition, not as harmless maintenance. Any fee-compounding path that changes ratio exposure, active range, or liquidation value must re-check borrow safety on the post-transition state.
  • Design bad-debt tooling as loss containment, not borrower-timed monetization. If a borrower-created underwater state can be finalized through restructureBadDebt, that path needs the same adversarial review as liquidation and borrowing.
  • Stress-test CLAMM-collateral designs under extreme-tick, one-sided-fee, and price-normalization scenarios rather than only under balanced-range assumptions.
  • Keep market-level circuit breakers ready for thin-pool collateral types: pause borrowing, zero collateral factors, or disable reinvest / bad-debt paths before attacker-authored fee inventory becomes lender loss.

Audit prompts

  • Are pending fees, claimable rewards, and active liquidity being treated as economically interchangeable collateral objects even though they convert into executable liquidity under very different path assumptions?
  • If a borrower manufactures fee inventory in a thin or attacker-dominated Uniswap V3 range, what exact haircut stops the protocol from honoring those fees at nearly full collateral strength?
  • Does reinvest preserve the same economic value that the borrowing engine assumed, or does it transform a one-sided receivable into much weaker live liquidity once price returns toward the market tick?
  • Which post-borrow state transitions can reveal that the protocol lent against a stronger pre-state than the one it can actually liquidate: reinvest, fee collection, range migration, deleveraging helpers, or bad-debt restructuring?
  • Can one actor perform borrow -> reinvest -> price normalization -> restructureBadDebt inside the same capital window before any independent liquidator or oracle sanity check can intervene?
  • Is bad-debt handling allowed to socialize losses from borrower-authored insolvency instead of forcing a real liquidation against executable collateral value?
  • For CLAMM NFT collateral, does the protocol model hostile tick placement, one-sided inventory, and impermanent-loss collapse explicitly, or does it rely on benign assumptions about where fees will later be reinserted?
  • If the protocol disallows direct borrow inflation but still lets borrowers self-manufacture the eventual bad-debt state, has it really protected lenders or only delayed how the same false value gets paid out?

Lessons that should already be standard

  • Pending fees are not the same thing as durable collateral. If value only exists as a receivable inside an attacker-shaped market state, lending against it as though it were already balanced liquidity is asking the protocol to finance its own unwind gap.
  • Auto-compounding is not neutral just because the function is mathematically correct. A correct reinvest at the wrong tick or wrong ratio assumption can be the exact moment paper collateral turns into real insolvency.
  • Thin concentrated-liquidity pools should be presumed attacker-authorable. If one trader can dominate active liquidity and farm their own fee inventory, fee history is part of the adversarial surface, not independent evidence of collateral quality.
  • Borrowing truth and loss-resolution truth must agree. If the protocol lends against one valuation but resolves bad debt against a much weaker post-transition value, the difference is effectively unsecured credit paid for by lenders.
  • Bad debt restructuring deserves the same scrutiny as liquidation bonuses or reserve donations. Once borrowers can choose when protocol loss becomes lender-socialized reality, cleanup code has become part of the exploit path.
  • Many LP-collateral designs fail not because they misread an oracle but because they mistake presentation value for executable unwind value. The right question is usually what survives hostile normalization?, not what does the current mark say?.

Internal linkages

Control surface

Graph View

Backlinks