# Swap token can be traded as fake base token

Vader Pools.swap never validates that base is USDV/VADER, letting an attacker pass base=token to corrupt pool accounting and drain token reserves.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Disclosed: 2021-06-14
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-04-vader-findings/issues/205
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-vader%3AH-11
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Pools.swap AMM function
**Root cause:** swap() does not verify that the base argument is one of the registered base tokens (USDV/VADER), so base and token can be the same asset, making getAddedAmount and calcSwapOutput use mismatched reserves.
**Steps:**
1. Transfer `token`s to the pool contract.
2. Call `swap(token, token, member, toBase=false)` with base set to the token itself.
3. Observe `_actualInput = getAddedAmount(base, token)` returns the token amount but `calcSwapOutput` divides by `mapToken_baseAmount[token]` and multiplies by `mapToken_tokenAmount[token]`, yielding a wrong output.
4. Alternatively send `tokenIn=baseAmount` of tokens and call `swap(base=token, token, member, toBase=false)` to extract token reserves cheaply.
**How found:** Code review of Pools.swap noticed the missing check that base is a registered base token, then traced how getAddedAmount and calcSwapOutput would behave when base==token.
**Exploitation:** Attacker transfers tokens into the pool then calls swap with base=token, so the contract credits base balance while debiting token balance, corrupting reserves; repeating with tokenIn=baseAmount lets them extract token pool funds at favorable ratio.
**Insight:** In AMM swap functions, always verify that the declared base/quote asset is in the whitelist of registered base tokens; if base and token can alias, reserve lookups silently use the wrong mapping and accounting breaks.