# Wrong implementation of function LBPair.setFeeParameter can break the funcionality of LBPair and make user's tokens locked 

Missing left-shift in LBPair._setFeesParameters ORs variable fee bits into low 144 bits, corrupting binStep and zeroing volatilityAccumulated, bricking swaps/mints and locking pool tokens.

- Payout: Contest reward
- Severity: high
- Program: Trader Joe
- Credited: KIntern\_NA
- Disclosed: 2022-12-22
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-10-traderjoe-findings/issues/384
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AH-03
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:misconfiguration

**Target:** LBPair.sol _setFeesParameters packed storage slot
**Root cause:** The 112 high bits holding variable fee params are OR'd into the low 144 bits without shifting left by 144, so they overwrite binStep and other low fields while zeroing the high fields.
**Steps:**
1. Create pair with binStep=25, add liquidity, mint, swap to raise volatilityAccumulated to 60000.
2. Call factory.setFeeParametersOnPair with new packed fee params.
3. Observe volatilityAccumulated reset to 0 and binStep becomes 60000|25=60025.
4. Any swap/mint/flashLoan reverts with BinStepOverflows since binStep > BASIS_POINT_MAX (10000).
**How found:** Code-reading of the assembly in _setFeesParameters: noticed _varParameters decoded into low bits then OR'd without shl(144), contradicting the intended [112 high][144 low] layout.
**Exploitation:** Admin-triggered setFeeParametersOnPair call corrupts storage; subsequent user operations revert, locking all tokens in the pool.
**Insight:** When auditing packed-struct assembly, verify every decode/encode offset and shift matches the intended bit layout; a missing shl silently corrupts adjacent fields rather than reverting.