# Denial of service

First depositor mints 1 wei native against large foreign deposit, setting totalLiquidityUnits to 1 and causing rounding-error DoS on the Vader pool.

- Payout: Audit contest
- Severity: high
- Program: Vader Protocol
- Found by: danb
- Disclosed: 2022-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-vader-findings/issues/98
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-vader%3AH-14
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:dos vuln:share-inflation

**Target:** VaderPoolV2.sol mintFungible liquidity accounting
**Root cause:** On first deposit totalLiquidityUnits is set to nativeDeposit only, ignoring foreignDeposit, so a 1-wei native deposit yields 1 liquidity unit backed by the entire pool reserves.
**Steps:**
1. Owner calls `setFungibleTokenSupport` for a new token (e.g. WETH).
2. Attacker calls `mintFungible` with `nativeDeposit == 1` and `foreignDeposit == 10 ether`.
3. `totalLiquidityUnits` becomes 1 while reserves hold ~10 ether.
4. Subsequent minters hit huge rounding error: either mint 0 liquidity and revert, or receive far fewer units than deserved.
**How found:** Code reading of the first-deposit branch in VaderPoolV2.sol#L334, noticing totalLiquidityUnits is set from nativeDeposit alone rather than a combined/min of both deposits.
**Exploitation:** Attacker seeds the pool with minimal native liquidity, then arbitrages the pool; rounding losses from later LPs accrue to reserves, increasing the value of the attacker's single liquidity token.
**Escalation:** Rounding-error losses compound into pool reserves, letting the attacker profit while deterring all future LPs, permanently DoSing the pair.
**Insight:** On first-deposit initialization, check whether liquidity units derive from only one side of the pair; a 1-wei seed against a large counter-deposit creates a share-inflation/rounding DoS that also lets the seeder harvest later LPs' rounding losses.