# Hijack token pool by burning liquidity token

Pool.burn lets anyone burn LP tokens without withdrawing, shrinking totalSupply to 1 so calcLiquidityUnits rounds all future deposits to 0 LP, locking the pool.

- Payout: Audit contest
- Severity: high
- Program: Spartan Protocol
- Found by: jonah1005
- Disclosed: 2021-09-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-07-spartan-findings/issues/38
- Library page: https://bugbountylibrary.com/r/c4%3A2021-07-spartan%3AH-10
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:share-inflation

**Target:** Pool / PoolFactory liquidity token accounting
**Root cause:** calcLiquidityUnits multiplies by totalSupply P; if P is tiny (1), integer division rounds new LP units to 0. burn() lets any LP holder destroy supply without withdrawing underlying tokens.
**Steps:**
1. Create a Pool via PoolFactory and add liquidity.
2. Call `dai_pool.functions.burn(init_amount-1)` to leave totalSupply == 1.
3. Victim transfers 1,000,000 DAI to pool and calls `addForMember(user)`.
4. Observe `balanceOf(user)` returns 0 LP despite the deposit.
**How found:** Read the calcLiquidityUnits formula, noticed multiplication by totalSupply P and integer division, hypothesized rounding to zero when P is small; confirmed with a Foundry/web3 script showing 1M DAI deposit yields 0 LP.
**Exploitation:** Attacker creates a pool, burns all but 1 LP token, becoming sole LP holder. Any subsequent depositor's calcLiquidityUnits rounds to 0, so their tokens are donated to the pool and the attacker (sole LP) can withdraw them.
**Escalation:** Attacker can repeat across pools they create; also grief existing pools by burning their own LP to shrink supply.
**Insight:** In AMM share math, any formula multiplying by totalSupply is vulnerable to share-inflation/rounding when supply can be driven to 1; check whether burn/transfer paths let an attacker shrink supply without withdrawing reserves.