# Ideal balance is not calculated correctly when providing imbalanced liquidity

Boot Finance customSwap computes ideal balance from raw self.balances instead of normalized _xp, so imbalanced deposits at non-1 target price earn inflated LP tokens.

- Payout: Audit contest
- Severity: high
- Program: Boot Finance
- Found by: jonah1005
- Disclosed: 2022-01-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-bootfinance-findings/issues/150
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-bootfinance%3AH-06
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** customSwap AMM addLiquidity / SwapUtils fee calculation
**Root cause:** Ideal balance is derived from self.balances (raw, un-normalized) rather than _xp(self, newBalances), so when target price != 1 the ideal ratio is wrong and fees/LP minted deviate proportionally to the price.
**Steps:**
1. Deploy Swap for DAI/LINK with target price 4*10**18.
2. Approve tokens, call `addLiquidity([deposit_amount, deposit_amount // 10], 10, 10**18)` depositing mostly DAI.
3. Compare LP balance before/after; observe ~4x more LP than a correctly-priced pool would grant.
4. Repeat with a second pool to confirm the deviation scales with target price.
**How found:** Code review of SwapUtils fee loop; noticed idealBalance uses self.balances instead of normalized balances, and reasoned that with target price != 1 the ideal ratio diverges, then validated with a PoC comparing LP minted across pools.
**Exploitation:** Attacker deposits the over-favored token into a customSwap pool whose target price deviates from 1, receiving inflated LP shares; can then withdraw/redeem against the pool to extract value from other LPs.
**Insight:** In forked/derivative AMMs, check whether fee and invariant math uses raw balances vs normalized (_xp) balances; any place raw balances feed a ratio-based ideal is suspect when token decimals or target prices differ from 1.