# Unsafe cast in IndexPool mint leads to attack

Unsafe uint120 cast in IndexPool.mint truncates ratio to 0, letting an attacker mint inflated LP tokens cheaply and drain pool reserves via burn.

- Payout: Audit contest
- Severity: high
- Program: Sushi
- Found by: cmichel
- Disclosed: 2021-11-22
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-09-sushitrident-findings/issues/77
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-sushitrident%3AH-09
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** IndexPool.mint LP token minting (Solidity contract)
**Root cause:** `uint120 ratio = uint120(_div(toMint, totalSupply))` truncates values >= 2**120 to 0 instead of reverting, so a caller-chosen toMint yields ratio 0 and near-free minting.
**Steps:**
1. Choose `toMint = 2**120 * totalSupply / BASE` so ratio = 2**120, truncated to 0 by the uint120 cast.
2. Or choose `ratio = 2**120 * totalSupply / BASE + 1e16` so amountIn = ratio*reserve/BASE still passes `require(amountIn >= MIN_BALANCE)` while paying only ~1/100th of reserves.
3. Call `IndexPool.mint` with that toMint to receive heavily inflated LP token supply.
4. Call `burn` with the inflated LP tokens to withdraw the entire pool reserves.
**How found:** Code review of the mint function spotted an explicit uint120 downcast of a caller-controlled division result; recognized Solidity 0.8.x casts don't revert, so values >= 2**120 truncate to 0.
**Exploitation:** Attacker calls mint with a crafted toMint that overflows the uint120 ratio cast, paying a tiny fraction of reserves (or passing MIN_BALANCE with ratio just above 2**120) while receiving massively inflated LP tokens, then burns them to withdraw all pool tokens.
**Insight:** In 0.8.x contracts, explicit downcasts still silently truncate—grep for `uintN(` casts on user-influenced arithmetic (especially share/ratio math) and check whether a value just above the type max can pass downstream MIN_BALANCE-style checks.