# LibSwap: Excess funds from swaps are not returned

LibSwap leaves unused swap input tokens stranded in the LI.FI contract instead of refunding them to the user after exact-output or chained swaps.

- Payout: Audit contest
- Severity: medium
- Program: LI.FI
- Found by: hickuphh3
- Disclosed: 2022-05-05
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-lifinance-findings/issues/33
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-lifinance%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LibSwap.sol swap library in LI.FI contracts
**Root cause:** Swap uses _swapData.fromAmount as the amount to pull/approve but never measures the actual amount consumed by the call, so any surplus remains in the contract balance.
**Steps:**
1. Call swap with fromAmount larger than needed (e.g. exact-output swap or second swap after exact-input)
2. Observe contract's fromAsset balance before and after the swap call
3. Note residual balance (e.g. 18.01 MATIC in the AnyswapFacet test) stays in the LI.FI contract
4. No refund path returns the difference to the user
**How found:** Code review of LibSwap swap flow noticing fromAmount is trusted rather than measured; confirmed by logging token balances around the AnyswapFacet exact-output test.
**Insight:** When a library trusts a caller-supplied input amount instead of measuring balance deltas around the external call, surplus tokens silently accumulate in the contract—check any swap/bridge facet for exact-output or multi-hop paths where consumed amount < specified amount.