# Index Pool always swap to Zero

IndexPool._pow missing braces on the for loop, so exponentiation-by-squaring is broken and swaps always return zero output tokens.

- Payout: Audit contest
- Severity: high
- Program: Sushi
- Found by: broccoli
- Disclosed: 2021-11-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-sushitrident-findings/issues/27
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-sushitrident%3AH-02
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** IndexPool.sol _pow / swap
**Root cause:** The for loop in _pow lacks braces, so only `a = a * a` is looped and the `if (n % 2 != 0) output = output * a` runs once after the loop with n==0, producing wrong/zero results.
**Steps:**
1. Deploy IndexPool with tokens (link, dai) and weights (2e18, 1e18).
2. Transfer link into pool via bento.transfer.
3. Call `pool.swap(encode_abi(['address','address','address','bool','uint256'],[link, dai, admin, false, 1e18]))`.
4. Observe dai balance delta is always 0.
**How found:** Code review of _pow against the exponentiation-by-squaring algorithm; noticed the missing braces around the loop body.
**Insight:** When reviewing math helpers, diff the implementation against the canonical algorithm (e.g. exponentiation by squaring) and check brace/scope placement—single-statement for loops silently drop intended body lines.