# Transfering funds to yourself increases your balance

LBToken._transfer reads both balances into temporaries; self-transfer overwrites _fromBalance with _toBalance, doubling the sender's balance on each call.

- Payout: Contest reward
- Severity: high
- Program: Trader Joe
- Credited: Dravee
- Disclosed: 2022-12-22
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-10-traderjoe-findings/issues/299
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LBToken.sol _transfer / safeTransferFrom (Solidity ERC-1155-like token)
**Root cause:** When _from == _to, _toBalance is read from the same slot as _fromBalance, so the second write `_balances[_id][_to] = _toBalance + _amount` overwrites the subtraction, netting +_amount instead of zero.
**Steps:**
1. Deploy pair, addLiquidity(1e18, ID_ONE, 5, 0) to get LB token id _ids[0] with balance 333333333333333333
2. Call `pair.safeTransferFrom(DEV, DEV, _ids[0], initialBalance)` — checkApproval passes since _owner == _spender
3. Observe balanceOf(DEV, _ids[0]) == 2 * initialBalance
4. Repeat self-transfer to keep doubling balance
**How found:** Code review of _transfer noticed the temporary-variable pattern (_fromBalance/_toBalance) known to cause past hacks, and traced the aliasing when _from == _to; confirmed with a Foundry PoC test.
**Exploitation:** Any LB token holder calls safeTransferFrom with _from == _to == self (approval modifier auto-passes for self), minting balance out of thin air; repeated calls inflate holdings arbitrarily, diluting other LPs and enabling draining of the pair's underlying assets.
**Escalation:** Repeat the self-transfer in a loop to exponentially inflate balance, then redeem inflated LB tokens for pool assets.
**Insight:** In balance-update code using cached temporaries, always check the aliasing case where source and destination slots are identical; self-transfers and same-account moves silently bypass the subtraction.