# HybridPool's reserve is converted to "amount" twice

HybridPool double-converts Bento share reserves to amounts in _getReserves, inflating reserves and letting swaps overpay output tokens, draining LPs.

- Payout: Audit contest
- Severity: high
- Program: Sushi
- Found by: cmichel
- Disclosed: 2021-11-22
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-09-sushitrident-findings/issues/101
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-sushitrident%3AH-08
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** HybridPool AMM contract reserves/swap logic
**Root cause:** _updateReserves stores reserves already converted from Bento shares to amounts, but _getReserves converts the stored reserve0/1 fields to amounts a second time, inflating them by the share price.
**Steps:**
1. Note _balance() converts Bento share balance to amount, so _updateReserves stores amount-denominated reserves.
2. Call swap; _getReserves() re-multiplies stored reserve by current amount/share price.
3. With share price 1.5 and share balance 1000, stored reserve is 1500 but _getReserves returns 2250.
4. Swap computes output against inflated reserve, paying out more tokens than owed.
**How found:** Code reading of _updateReserves vs _getReserves revealed the reserve was converted from shares to amounts in both places.
**Exploitation:** Attacker swaps against the pool; inflated output reserve from double conversion yields excess output tokens, extracting value from LPs.
**Insight:** When a contract stores a derived value, check every read path for re-application of the same conversion; reserve/share-price conversions are a common double-conversion trap in AMM wrappers over lending pools.