# Rebalance logic is wrong and this distorts the pool's important states

Timeswap pool rebalance used long0Balance instead of long1Balance when computing fee-adjusted amount, corrupting long1Balance and pool invariant, exploitable permissionlessly for profit.

- Payout: Contest reward
- Severity: high
- Program: Timeswap
- Credited: hansfriese
- Disclosed: 2023-03-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-timeswap-findings/issues/269
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-timeswap%3AH-01
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** TimeswapV2Pool rebalance() in Pool.sol library
**Root cause:** In the isLong0ToLong1 / GivenLong1 branch, FeeCalculation.removeFees is called with pool.long0Balance instead of pool.long1Balance, so the fee-adjusted comparison and subsequent long1Balance update (including zeroing at L685) use the wrong value.
**Steps:**
1. Call TimeswapV2Pool.rebalance() with param.isLong0ToLong1=true and transaction=GivenLong1.
2. Observe L679 computes long1AmountAdjustFees from pool.long0Balance rather than pool.long1Balance.
3. Choose param.delta equal to that miscomputed value so the branch at L681 executes.
4. L684-685 set longFees = pool.long1Balance - delta and pool.long1Balance = 0, distorting long1Balance, long1FeeGrowth, long1ProtocolFees.
5. Repeat to break pool invariant and extract value.
**How found:** Code review of the rebalance function in Pool.sol, spotting that the GivenLong1 branch under isLong0ToLong1 reads pool.long0Balance where pool.long1Balance is required.
**Exploitation:** Permissionless rebalance() lets any attacker supply crafted delta to trigger the wrong branch, zeroing long1Balance and mis-updating fee growth/protocol fees, breaking the invariant to profit at the pool's expense.
**Insight:** In symmetric swap branches, verify each direction reads the balance of the token being consumed; a copy-paste of the mirrored branch's variable is a common source of invariant-breaking state corruption.