# division rounding error in _handleExecuteLiquidity() and _reconcile() make routerBalances and contract fund balance to get out of sync and cause fund lose

Integer division in Connext's fast-liquidity router deduction and reconcile leaves routerBalances out of sync with actual contract funds, causing small fund leaks and temporary bad debt.

- Payout: Audit contest
- Severity: medium
- Program: Connext
- Found by: unforgiven
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-connext-findings/issues/213
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-connext%3AM-16
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** BridgeFacet.sol fast-liquidity execution and reconcile logic
**Root cause:** `toSwap / pathLen` truncates when splitting liquidity across routers, so the sum deducted from routerBalances is less than the toSwap amount actually paid out; reconcile re-adds using a different (fee-inclusive) base, producing a different rounding remainder.
**Steps:**
1. Call `execute` with `_isFast=true`, `_args.amount` not evenly divisible by `_args.routers.length`, and multiple routers.
2. Observe `routerAmount = toSwap / pathLen` truncates; loop subtracts `routerAmount*pathLen < toSwap` from `routerBalances`.
3. Contract pays out full `toSwap` to user, so contract token balance drops more than routerBalances.
4. Later `_reconcile()` adds back amounts computed on a different base (no fee subtraction), leaving a residual mismatch between sum of routerBalances and contract balance.
**How found:** Code review of the fast-liquidity deduction loop and reconcile path, noticing integer division truncation and that the two functions use different bases (fee-adjusted vs not), so rounding remainders differ.
**Exploitation:** Not a direct theft; each transfer leaks a few wei of token value and creates temporary bad debt until reconcile, potentially limiting other routers' withdrawals in the interim.
**Insight:** When splitting an amount across N recipients via integer division, the truncated remainder is silently absorbed by the contract; check every place the same logical amount is divided on different bases (fee-adjusted vs gross) since the remainders won't cancel.