# getAddedAmount can return wrong results

getAddedAmount misreads token balances for non-pool tokens, letting anyone call sync to corrupt pair accounting and swap tokens for free.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Disclosed: 2021-06-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-04-vader-findings/issues/206
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-vader%3AH-12
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Vader Protocol pool contract (getAddedAmount/sync/swap)
**Root cause:** getAddedAmount only handles (VADER/USDV, pool) or (pool, pool); for any other token it reads that token's balance and subtracts it from mapToken_tokenAmount[_pool], which may belong to a different token, corrupting stored accounting.
**Steps:**
1. Call `sync(token1, token2)` where `token1` balance is less than `mapToken_tokenAmount[token2]`.
2. The difference is added to `mapToken_tokenAmount[token2]`, breaking pair accounting.
3. Call `swap(token1, token2, member, toBase=false)` to swap tokens without paying.
**How found:** Code reading of getAddedAmount's branches: noticed it only works for VADER/USDV or pool, and that the else path subtracts an arbitrary token balance from a stored amount keyed by pool.
**Exploitation:** Attacker calls sync with a token whose balance is below the stored amount for another token, inflating mapToken_tokenAmount[token2], then swaps via swap(token1, token2, member, toBase=false) to obtain tokens without payment.
**Insight:** When a helper reads balances keyed by one token but subtracts from a mapping keyed by pool, check every caller for token/pool mismatches; sync-style functions that trust stored amounts are prime targets for accounting corruption.