# Liquidity providers may lose funds when adding liquidity

Caviar Pair.add mints LP tokens using min of two token-share ratios, so imbalanced deposits silently donate excess tokens to the pool, causing LP fund loss.

- Payout: Contest reward
- Severity: high
- Program: Caviar
- Credited: Jeiwan
- Disclosed: 2023-01-26
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-caviar-findings/issues/376
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-caviar%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Pair.add liquidity provision in AMM pool contract
**Root cause:** LP tokens minted as Math.min(baseTokenShare, fractionalTokenShare); when deposit proportions differ from reserves, the excess of the larger-proportion token is not refunded and is effectively donated to the pool. minLpTokenAmount only bounds slippage on LP tokens, not token-amount disproportion.
**Steps:**
1. Alice (first LP) calls `p.add(10 ether, 10 ether, 0)` setting reserves 10/10.
2. Bob calls `p.add(1.2 ether, 1 ether, 1e18)`; baseTokenShare=1.2e18, fractionalTokenShare=1e18, min=1e18 LP minted.
3. Bob calls `p.remove(1e18, 0, 0)` and receives only ~1.018 ether USD and 1 ether fractional token, losing ~0.18 ether of USD.
**How found:** Code review of add() minting logic: noticed LP amount uses Math.min of two independently computed shares, so a mismatch between deposit ratio and reserve ratio leaves unredeemable excess; wrote a Foundry PoC confirming Bob's USD loss after remove().
**Exploitation:** Any LP adding liquidity at a ratio differing from current reserves overpays; the excess is socialized to all LPs. Attacker could front-run/sandwich a victim's add() by skewing reserves so the victim's deposit is heavily imbalanced, capturing the donated excess via their own LP position.
**Insight:** In AMM add-liquidity, check whether minted shares use min() of per-token ratios without refunding the surplus token; any deposit not matching reserve ratio silently donates value, and can be weaponized by skewing reserves before a victim's add().