# WhitelistPeriodManager: Improper state handling of exclusion additions

Excluding an address with existing LP liquidity in Biconomy's WhitelistPeriodManager leaves totalLiquidity stale, inflating getMaxCommunityLpPositon and blocking other LPs from adding liquidity.

- Payout: Audit contest
- Severity: medium
- Program: Biconomy
- Found by: hickuphh3
- Disclosed: 2022-07-25
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-biconomy-findings/issues/75
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-biconomy%3AM-16
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** Hyphen WhitelistPeriodManager liquidity cap accounting
**Root cause:** setIsExcludedAddressStatus adds addresses to isExcludedAddress without decrementing totalLiquidity and totalLiquidityByLp, so excluded addresses' liquidity still counts toward per-token caps and getMaxCommunityLpPositon assumes excluded addresses hold zero liquidity.
**Steps:**
1. Set caps: `wlpm.setCaps([token],[500],[500])`
2. Owner adds liquidity: `liquidityProviders.connect(owner).addTokenLiquidity(token, 500)`
3. Exclude owner: `wlpm.setIsExcludedAddressStatus([owner.address],[true])`
4. Observe `getMaxCommunityLpPositon(token)` returns 500 instead of 0
5. Bob's `addTokenLiquidity(token,1)` reverts with `ERR__LIQUIDITY_EXCEEDS_PTTC`
**How found:** Code review of setIsExcludedAddressStatus noting totalLiquidity mappings are not updated on exclusion, then reasoning about getMaxCommunityLpPositon's implicit assumption that excluded addresses hold zero liquidity; confirmed with a Foundry/Hardhat test.
**Exploitation:** No direct theft; a whitelisted/excluded LP's stale liquidity permanently consumes the per-token cap, denying other community LPs from providing liquidity (griefing/DoS of cap accounting).
**Insight:** When a contract maintains aggregate counters (totalLiquidity) alongside per-address state, audit every mutation path that flips an address's eligibility flag — exclusion/whitelist toggles often skip counter reconciliation, letting stale balances consume global caps.