# LBRouter.removeLiquidity returning wrong values

LBRouter.removeLiquidity swaps token order internally but returns amounts in unswapped order, so integrators receive amountX/amountY reversed, corrupting their accounting.

- Payout: Contest reward
- Severity: medium
- Program: Trader Joe
- Credited: Lambda
- Disclosed: 2022-12-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-10-traderjoe-findings/issues/105
- Library page: https://bugbountylibrary.com/r/c4%3A2022-10-traderjoe%3AM-01
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** LBRouter.removeLiquidity (Solidity smart contract)
**Root cause:** When caller passes tokens out of pair order, the function swaps _tokenX/_tokenY and _amountXMin/_amountYMin locally, but the returned amountX/amountY from _removeLiquidity are not re-swapped back to caller order.
**Steps:**
1. Call `LBRouter.removeLiquidity(token18D, token6D, ...)` with token addresses in reverse of pair order (token6 < token18).
2. Function swaps _tokenX/_tokenY and mins internally, then calls `_removeLiquidity`.
3. Observe returned `amountFirstRet` equals token6 balance delta (second token), and `amountSecondRet` equals token18 delta (first token).
4. Compare with in-order call where returns match caller token order.
**How found:** Code review of LBRouter.removeLiquidity noticed the local swap of _tokenX/_tokenY and mins but no corresponding swap of the returned amounts; confirmed via a modified test reversing token order.
**Exploitation:** Third-party integrators doing `(amountA, amountB) = removeLiquidity(tokenA, tokenB, ...)` and crediting `contractBalanceA += amountA` will mis-account when tokenA > tokenB, potentially leading to downstream fund loss in their own contracts.
**Insight:** When a function normalizes argument order internally, audit every output derived from those normalized variables to ensure it is de-normalized back to caller order before returning.