# 4 Synths can be minted with fake base token

Pools.mintSynth never validates that base is USDV/VADER, so passing an arbitrary token as base mints synths at a wrong, attacker-favorable ratio.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Disclosed: 2021-06-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-04-vader-findings/issues/207
- Library page: https://bugbountylibrary.com/r/c4%3A2021-04-vader%3AH-13
- Tags: area:web3 domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** Pools.mintSynth AMM contract function
**Root cause:** mintSynth does not restrict `base` to the whitelisted base tokens (USDV/VADER); getAddedAmount and calcSwapOutput then price the deposit against the wrong reserve, breaking pool accounting.
**Steps:**
1. Transfer an arbitrary `token` amount to the pool contract.
2. Call `mintSynth(token, token, member)` setting `base=token`.
3. `_actualInput = getAddedAmount(base, token)` returns the token amount added.
4. `calcSwapOutput(_actualInput, mapToken_baseAmount[token], mapToken_tokenAmount[token])` computes `tokenIn / baseAmount * tokenAmount`, a wrong swap result.
5. Receive minted synths while the base balance is credited instead of the token balance.
**How found:** Code review of mintSynth's input handling: noticed no check that `base` is one of the base tokens, then traced getAddedAmount/calcSwapOutput to see the ratio would be computed against the wrong reserve.
**Exploitation:** Attacker deposits a cheap or high-precision token while naming it as `base`, so the ratio math uses the token's own reserve figures and mints synths cheaper than sending real base tokens; pool accounting is corrupted since tokens are transferred in but base balance is increased.
**Insight:** For AMM mint/swap entrypoints, verify every token argument is validated against the whitelist; passing the same token as both base and quote silently reuses one reserve for ratio math and misprices the mint.