# Swap functions are Reenterable

Swap/bridge functions in LI.FI record balance before and after external swap calls, letting a reentrant call to withdraw or deposit corrupt postSwapBalance accounting.

- Payout: Audit contest
- Severity: medium
- Program: LI.FI
- Found by: kirk-baird
- Disclosed: 2022-05-05
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-lifinance-findings/issues/109
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-lifinance%3AM-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:reentrancy

**Target:** Solidity Diamond facets (GenericSwapFacet, CBridgeFacet, AnyswapFacet, HopFacet, NXTPFacet)
**Root cause:** Swap functions compute postSwapBalance as ownBalance(after) - ownBalance(before) around _executeSwaps(), which makes external calls to AMMs and untrusted ERC20 tokens; a reentrant call that moves funds in or out of the contract during the swap skews that delta.
**Steps:**
1. Call `swapTokensGeneric()` (or a swapAndStartBridge* function) with `_swapData` whose target is an attacker-controlled contract.
2. During `_executeSwaps()`, reenter `WithdrawFacet.withdraw()` to move the receiving asset out of the contract.
3. Return to the outer call; `postSwapBalance = getOwnBalance(receivingAssetId) - receivingAssetIdBalance` is now understated/overstated.
4. Alternatively reenter a function that transfers funds into the contract so the inflated delta is paid out to msg.sender via `transferAsset`.
**How found:** Code review of swap functions noting the balance-delta pattern around _executeSwaps(), which performs external calls to AMMs and untrusted ERC20 tokens, creating a reentrancy window.
**Exploitation:** Attacker supplies a malicious swap target invoked by _executeSwaps and reenters withdraw/deposit to manipulate the before/after balance delta, causing the contract to mis-account and transfer an incorrect amount to msg.sender or bridge.
**Insight:** Balance-delta accounting (balanceOf after minus before) around external calls is a reentrancy target: any function that moves the same token in or out during the swap window corrupts the delta, so audit every entry point sharing that token's balance, not just the swap function itself.