# Attacker can steal entire reserves by abusing fee calculation

LBToken exempts pair/zero address from fee-debt caching, so minting LP tokens to the pair accrues unearned fees that overflow fee totals and drain reserves via swap.

- Payout: Contest reward
- Severity: high
- Program: Trader Joe
- Credited: Trust
- Disclosed: 2022-12-22
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2022-10-traderjoe-findings/issues/423
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AH-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:fee-bypass

**Target:** LBPair/LBToken fee accounting (Solidity, EVM)
**Root cause:** _beforeTokenTransfer skips _cacheFees when _from or _to is the pair or zero address, so freshly minted LP tokens held by the pair accrue fees from zero to current accTokenPerShare; collectFees then decrements feesX/feesY.total inside an unchecked block, allowing overflow.
**Steps:**
1. Transfer amount X of token to the pair
2. Call `pair.mint(_ids, _distributionX, _distributionY, address(pair))` so LP tokens are minted to the pair itself
3. Call `pair.collectFees(address(pair), _ids)` — pair pays itself fees, decrementing feesX/feesY.total without changing balance (unchecked, can overflow)
4. Call `pair.swap(true, attacker)` — received() credits attacker with the inflated fees, draining reserves
5. Call `pair.burn(_ids, amounts, attacker)` to recover deposited assets
**How found:** Code reading of _beforeTokenTransfer noticed the `_from != address(this)` / `_to != address(this)` exemption from _cacheFees, hypothesized the pair address accrues fees from zero, then traced collectFees unchecked subtraction and swap received() accounting to full drain.
**Exploitation:** Attacker deposits tokens, mints LP to the pair address to accrue unearned fees, self-collects fees to corrupt fee totals (overflowing via unchecked subtraction), then swaps to extract reserve assets and burns to recover principal.
**Escalation:** Repeated attack drains entire reserves; unchecked block turns fee-only loss into full reserve theft.
**Insight:** When a token hook exempts certain addresses (self, zero) from debt/accounting updates, check whether those addresses can later claim accrued value; also check whether fee-total decrements are unchecked, enabling overflow to inflate credited amounts.