# Wrong formula when add fee incentivePool can lead to loss of funds.

LiquidityPool.getAmountToTransfer divides the entire incentivePool balance by BASE_DIVISOR on each fee accrual, zeroing it and locking tokens in the contract.

- Payout: Audit contest
- Severity: high
- Program: Biconomy
- Found by: minhquanym
- Disclosed: 2022-07-25
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-biconomy-findings/issues/38
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-biconomy%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** Solidity LiquidityPool contract (Hyphen bridge) getAmountToTransfer
**Root cause:** Parentheses misplaced: the whole expression (existing incentivePool + new fee) is divided by BASE_DIVISOR instead of only the new fee, so the accumulated pool is repeatedly divided by 1e10.
**Steps:**
1. Open LiquidityPool.sol lines 319-322 in getAmountToTransfer.
2. Observe `incentivePool[tokenAddress] = (incentivePool[tokenAddress] + (amount * (transferFeePerc - equilibriumFee))) / BASE_DIVISOR;`.
3. Note each call divides prior incentivePool by BASE_DIVISOR (1e10), shrinking it toward zero.
4. After a few transfers incentivePool[tokenAddress] becomes 0, locking accrued tokens in the contract.
**How found:** Code reading of the fee-accrual arithmetic in getAmountToTransfer; noticed the division applied to the whole sum rather than just the incremental fee, then algebraically rewrote the expression to confirm the repeated division.
**Exploitation:** Any user triggering transfers with fees causes the incentivePool accumulator to be divided by 1e10 each time; repeated normal usage drives the pool to zero, permanently locking the accrued fee tokens in the contract with no withdrawal path.
**Insight:** When auditing accumulator updates, check operator precedence/parentheses: a divisor applied to the whole `(existing + delta)` expression silently decays state by the divisor each call instead of scaling only the delta.