# Users can lose value in emergency state

LaunchEvent emergencyWithdraw reverts because WAVAX reserve was spent on liquidity, and users get no LP tokens back, losing their entire deposit.

- Payout: Audit contest
- Severity: high
- Program: Trader Joe
- Found by: cmichel
- Disclosed: 2022-03-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-trader-joe-findings/issues/199
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-trader-joe%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LaunchEvent contract
**Root cause:** createPair sets wavaxReserve=0 after using WAVAX to provide liquidity, so emergencyWithdraw cannot pay out WAVAX; it also fails to return LP tokens to users.
**Steps:**
1. Call `LaunchEvent.createPair()`: sets `wavaxReserve = 0`, adds liquidity, contract receives `lpSupply` LP tokens.
2. Call `LaunchEvent.allowEmergencyWithdraw()` to enter emergency/paused mode, disabling normal withdrawals.
3. User calls `LaunchEvent.emergencyWithdraw`; it reverts because WAVAX reserve is zero and LP tokens are not transferred.
4. User deposit is permanently stuck.
**How found:** Code reading of the createPair/emergencyWithdraw state interaction: noticed wavaxReserve is zeroed when liquidity is provided, then reasoned that emergencyWithdraw depends on that reserve and never returns LP tokens.
**Exploitation:** No attacker action needed; any user attempting to withdraw during emergency state loses their entire deposit because the payout path reverts and LP tokens are withheld.
**Insight:** When a contract swaps user deposits into LP positions, audit the emergency/pause exit path separately: check that the asset actually held (LP tokens) is what gets returned, not the original token whose reserve was consumed.