# WhitelistPeriodManager: Improper state handling of exclusion removals

Removing an address from the exclusion list leaves totalLiquidityByLp stale, causing subtraction overflow that bricks LP withdrawals from the farming contract.

- Payout: Audit contest
- Severity: medium
- Program: Biconomy
- Found by: hickuphh3
- Disclosed: 2022-07-25
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-biconomy-findings/issues/72
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-biconomy%3AM-15
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** WhitelistPeriodManager / LiquidityFarming contract (Solidity)
**Root cause:** setIsExcludedAddressStatus flips isExcludedAddress to false but does not update totalLiquidity and totalLiquidityByLp mappings, so accounting assumes the address still holds excluded liquidity.
**Steps:**
1. Exclude liquidity farming contract 0xA via setIsExcludedAddressStatus([0xA],[true]).
2. Bob deposits LP tokens via farmingContract.deposit(1, bob.address).
3. Owner calls setIsExcludedAddressStatus([farmingContract.address],[false]).
4. Bob calls farmingContract.connect(bob).withdraw(1, bob.address) -> reverts with panic 0x11 (underflow) because totalLiquidityByLp[USDC][0xA] is 0.
**How found:** Code review of the exclusion setter against the accounting mappings; noticed totals are only incremented on deposit and never reconciled when exclusion status is removed, then reproduced with a Hardhat test.
**Exploitation:** No attacker profit; the owner's exclusion removal causes withdrawals to revert via arithmetic underflow, temporarily locking staked LP tokens until the address is re-excluded.
**Insight:** When a flag gates whether accounting counters are incremented, audit every transition of that flag: toggling it off leaves counters inconsistent and turns later subtractions into underflows.