# Slippage checks when adding liquidity are too strict

UniswapHandler.addLiquidity uses full contract balances with 95% min amounts, so unbalanced balances (griefable via token transfer) revert liquidity adds.

- Payout: Audit contest
- Severity: medium
- Program: Malt Finance
- Found by: cmichel
- Disclosed: 2022-02-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-malt-findings/issues/257
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-malt%3AM-27
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** UniswapHandler.addLiquidity / buyMalt in Malt Finance Solidity contracts
**Root cause:** addLiquidity uses the contract's entire malt/reward token balances as amountDesired and sets amountMin to 95% of those balances, assuming the contract balance ratio matches the Uniswap pool reserve ratio.
**Steps:**
1. Observe `UniswapHandler.buyMalt` calls `router.addLiquidity(malt, rewardToken, maltBalance, rewardBalance, maltBalance*95/100, rewardBalance*95/100, msg.sender, now)`.
2. Note amountMin is derived from raw contract balances, not pool ratio.
3. Transfer tokens to the contract to skew the malt:reward balance ratio away from the pool reserve ratio.
4. Call the path invoking addLiquidity; router reverts because 95% min amounts cannot be satisfied, blocking liquidity addition (griefing).
**How found:** Code review of the addLiquidity call: warden questioned the assumption that contract balances are already balanced and that 95% of raw balances is a valid slippage bound.
**Exploitation:** Attacker donates tokens to the UniswapHandler contract to unbalance its malt/reward balances relative to the pool reserves, causing router.addLiquidity to revert and denying liquidity provisioning.
**Insight:** When a contract computes slippage minimums from its own token balances rather than the pool's current reserve ratio, any external token transfer can skew the ratio and force reverts—check whether min-amount math derives from manipulable balances.