# Zero weighted baskets are allowed to steal funds

Publisher creates a zero-token/zero-weight basket, mints shares for free, then republishes real weights and burns to drain depositor funds.

- Payout: Audit contest
- Severity: medium
- Program: Kuiper
- Found by: csanuragjain
- Disclosed: 2022-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-defiprotocol-findings/issues/21
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-defiprotocol%3AM-21
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Basket/Factory smart contracts (validateWeights, mint, publishNewIndex, burn)
**Root cause:** validateWeights only checks _tokens.length == _weights.length, so an empty tokens/weights array passes; pullUnderlying loops over zero weights and transfers nothing while _mint still credits shares.
**Steps:**
1. Call `proposeBasketLicense` with empty `tokens: {}` and `weights: {}`; `validateWeights` passes since 0==0.
2. Call `createBasket(idNumber)`; the weight loop is skipped, no tokens transferred, publisher gets BASE minted.
3. Publisher calls `mint(10)`; `pullUnderlying` loops zero times so no deposit, but `_mint(to,10)` credits 10 shares.
4. Call `publishNewIndex(realTokens, realWeights)` twice (first sets pending, second starts auction), settle auction.
5. Call `burn(10)`; `pushUnderlying` pays out real underlying for the free shares, draining the basket.
**How found:** Code review of validateWeights noticing the only check is length equality, then tracing mint/pullUnderlying to see zero-weight loop skips transfers while shares are still minted.
**Exploitation:** Publisher sets up an empty basket, mints shares with no collateral, then swaps in real weights via publishNewIndex and burns the free shares to extract underlying tokens deposited by other users.
**Escalation:** Judge notes publisher can re-base/dilute the basket at will by changing weights, amplifying the drain beyond the zero-weight case.
**Insight:** When a validation function only checks array-length equality, test the empty-array case: zero-length loops silently skip collateral pulls while share minting still executes, creating unbacked shares.