# Using single total native reserve variable for synth and non-synth reserves of VaderPoolV2 can lead to losses for synth holders

VaderPoolV2 tracks synth-minted and LP native deposits in one reserve variable, letting exiting LPs drain synth minters' USDV.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: hyh
- Disclosed: 2022-05-03
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-12-vader-findings/issues/179
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-12
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** VaderPoolV2 / BasePoolV2 AMM pool reserve accounting
**Root cause:** A single total native reserve variable is used both for LP share mint/burn math and for synth-mint deposits, so synth-provided native assets are credited to LP share value without issuing shares to synth minters.
**Steps:**
1. Alice deposits 100 USDV + 100 foreign as LP, receiving liquidity shares.
2. Bob deposits 100 USDV and mints foreign synths; total reserveNative rises but no LP shares issued to Bob.
3. Alice burns 95% of her shares; BasePoolV2 burn returns 95% of total reserves: 190 USDV and 95 foreign.
4. Bob burns synth and withdraws; VaderMath.calculateSwap with x=100, X=10, Y=5 yields ~0.4 USDV instead of his 100.
**How found:** Code reading of VaderPoolV2/BasePoolV2: noticed synth mint increases reserveNative (line 187) but issues no LP shares, while LP mint/burn (lines 497/223/336/401) uses that same total reserveNative, implying synth deposits are silently shared with LPs.
**Exploitation:** An LP mints shares when reserves are low, waits for synth minters to add native assets (inflating total reserveNative), then burns a large share fraction to withdraw a proportional cut of the synth minters' native deposits, leaving synth holders undercollateralized.
**Insight:** In AMM forks, check whether every path that increases a reserve variable also mints shares; any deposit path that bumps reserves without share issuance is value donated to existing LPs.