# ConstantProductPool & HybridPool: Adding and removing unbalanced liquidity yields slightly more tokens than swap

Unbalanced liquidity mint fee in Sushi ConstantProductPool/HybridPool is rebated to the minter, making add/remove liquidity marginally cheaper than an equivalent swap.

- Payout: Audit contest
- Severity: medium
- Program: Sushi
- Found by: GreyArt
- Disclosed: 2021-11-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-sushitrident-findings/issues/34
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-sushitrident%3AM-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:accounting-error vuln:fee-bypass

**Target:** ConstantProductPool and HybridPool AMM contracts
**Root cause:** _nonOptimalMintFee charges a fee on the excess token for unbalanced mints, but the fee is minted back to the minter instead of being distributed to existing LPs via reserve increments.
**Steps:**
1. Initialize pool with ~53586.556 ETH and 165143020.5295 USDC.
2. Mint unbalanced LP with 5 ETH and 0 USDC, receiving 138573488720892/1e18 LP tokens.
3. Burn the minted LP tokens, receiving 2.4963 ETH and 7692.40 USDC.
4. Equivalent to swapping 2.5037 ETH for 7692.4044 USDC, which is 0.03 USDC more than a direct swap (7692.369221).
**How found:** Compared the economics of unbalanced mint+burn against a direct swap and noticed the mint fee was returned to the minter rather than accruing to existing LPs.
**Exploitation:** Repeatedly add and remove unbalanced liquidity to capture the fee rebate versus swapping directly; gain is negligible per round but systematic.
**Insight:** When an AMM charges a fee on unbalanced liquidity, verify the fee accrues to existing LPs (reserve increment) rather than being minted back to the depositor, otherwise mint/burn becomes a fee-free swap path.