DeFi

Liquidity Pool

A liquidity pool is a smart contract reserve of assets used for swaps, lending, liquidations, pricing, or vault accounting.

A liquidity pool is shared token inventory that protocols use to trade or price assets.

Liquidity Pool Explained in Detail

A liquidity pool holds tokens that users or protocols can trade against, borrow from, or use as a pricing source. AMM pools quote prices from reserves and formulas instead of order books.

Pool balances often influence swaps, vault shares, liquidations, rewards, and oracle reads.

Smart contract example

uint256 price = reserve1 * 1e18 / reserve0;

This kind of spot-reserve price can be manipulated if the pool has low liquidity or can be moved in one transaction.

Liquidity Pool in Auditing

Liquidity pools are composable. A lending protocol, vault, or liquidation engine may trust pool data without realizing how easy it is to move.

Auditors check whether the protocol reads raw balances, stale reserves, spot prices, or manipulated LP values.

Red flags in code

  • Raw balanceOf is treated as a trusted reserve.

  • Spot pool price is used as an oracle.

  • Direct token donations change accounting.

  • Fee-on-transfer or rebasing tokens are not handled.

  • Low-liquidity pools influence high-value decisions.

How to test or review it

  • Manipulate reserves with swaps, donations, and flash loans.

  • Check sync and update behavior.

  • Test slippage and rounding boundaries.

  • Review LP token valuation formulas.

  • Confirm oracle logic does not depend on one manipulable pool read.

AMM

An AMM, or automated market maker, is a decentralized exchange design where smart contracts quote trades from liquidity and formulas instead of an order book.

Price Manipulation

Price manipulation is the intentional movement of an asset, pool, share, or collateral price so a protocol values assets incorrectly.

Oracle Manipulation

Oracle manipulation occurs when an attacker distorts a data source that a smart contract trusts, causing the contract to make decisions from unsafe data.

Practice this in real audit scenarios

Definitions help, but auditors need reps. SCH turns concepts like Liquidity Pool into exploit labs, code review habits, and report-writing practice.

Start the free trial or see the full smart contract auditing course.

Sources