# Mixing different types of LP shares can lead to losses for Synth holders

Synth minters receive no LP shares, so a normal LP can withdraw the entire pool, leaving Synth holders unable to redeem their funds.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: hyh
- Disclosed: 2022-02-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-11-vader-findings/issues/257
- Library page: https://bugbountylibrary.com/r/c4%3A2021-11-vader%3AH-33
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** DEX pool LP share accounting (BasePoolV2/VaderPoolV2)
**Root cause:** Synth minting adds liquidity to the pool without minting corresponding LP shares, so share-based withdrawal accounting lets existing LPs drain assets that Synth minters contributed.
**Steps:**
1. LP deposits both sides into the pool, receiving LP shares.
2. Attacker/user mints a Synth, adding liquidity but receiving no LP shares.
3. LP calls burn on NFT LP (`BasePoolV2.sol#L270`) or fungible LP (`VaderPoolV2.sol#L374`) withdrawing all pool liquidity since they own all shares.
4. Synth minter cannot withdraw; no assets remain.
**How found:** Code review of the three mint/burn paths (NFT, fungible, Synth) revealed Synths add liquidity without receiving shares, making share-based withdrawal accounting inconsistent.
**Exploitation:** A normal LP mints shares, waits for Synth minters to add liquidity, then burns all LP shares to withdraw the full pool balance including Synth-contributed assets, leaving Synth holders with unredeemable positions.
**Insight:** When a protocol has multiple liquidity-entry paths, check whether each path mints proportional ownership; any path that adds assets without shares lets other shareholders withdraw those assets.