# IndexPool pow overflows when weightRatio > 10.

IndexPool price pow() overflows when weightRatio exceeds ~10, reverting all swaps and bricking the pool permanently.

- Payout: Audit contest
- Severity: high
- Program: Sushi
- Found by: broccoli
- Disclosed: 2021-11-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-sushitrident-findings/issues/28
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-sushitrident%3AH-03
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** IndexPool.sol price calculation (pow)
**Root cause:** pow() in price calc uses inconsistent decimal scaling; weightRatio is 18-decimals but not divided by BASE^exp, so large ratios overflow uint and revert.
**Steps:**
1. Deploy a 1:10 IndexPool via master_deployer.deployPool with weights `(10**18, 10*10**18)` and swapFee `10**13`.
2. Attempt to swap link for dai against the pool.
3. Transaction reverts due to pow overflow in IndexPool.sol L255-L266.
**How found:** Code review of price calculation; noticed pow() with large weightRatio overflows and confirmed by deploying a 1:10 pool and observing swap reverts.
**Exploitation:** No value extraction; pool becomes unusable — LPs can add liquidity but no swaps succeed, requiring redeploy.
**Insight:** When a price formula uses pow with a ratio exponent, check decimal scaling of the ratio against BASE^exp — asymmetric weights (e.g. 1:10) are the trigger, not extreme values.