# Incentive Pool can be drained without rebalancing the pool

depositErc20 allowed toChainId equal to source chain and receiver equal to caller, letting attacker claim the full incentive pool reward without rebalancing.

- Payout: Audit contest
- Severity: medium
- Program: Biconomy
- Found by: kyliek
- Disclosed: 2022-07-25
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-biconomy-findings/issues/87
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-biconomy%3AM-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** Hyphen LiquidityPool.depositErc20 / sendFundsToUser
**Root cause:** depositErc20 does not validate that toChainId differs from the source chain nor that receiver differs from msg.sender, so a self-directed same-chain deposit still triggers the incentivePool reward payout.
**Steps:**
1. Wait until pool is in deficit (currentLiquidity << providedLiquidity) so incentivePool[token] is large.
2. Borrow/obtain liquidityDifference = providedLiquidity - currentLiquidity of the token.
3. Call `depositErc20(token, amount>=liquidityDifference, toChainId=currentChainId, receiver=msg.sender)`.
4. Executor calls `sendFundsToUser` to msg.sender, paying rewardAmount = entire incentivePool minus ~0.01% equilibrium fee and gas fee.
5. Repeat on each chain whenever incentive pool is profitable.
**How found:** Code reading of depositErc20/sendFundsToUser reward logic: noticed rewardAmount is set to the whole incentivePool when amount >= liquidityDifference, and that no check prevents toChainId == source chain or receiver == msg.sender.
**Exploitation:** Attacker supplies collateral equal to the liquidity deficit, makes a same-chain self-receiver deposit, and receives the full incentivePool reward while the pool returns to its prior deficit state; profit is rewardAmount minus fees.
**Escalation:** Repeatable across every deployed chain and after each large transfer that refills the incentive pool.
**Insight:** In cross-chain bridge reward logic, check whether the reward condition can be satisfied by a self-loop (same source/dest chain, self receiver) that never actually moves liquidity; the reward branch keyed on liquidityDifference is the tell.