# User can exponentially increase the value of their position through the memorializePositions function

PositionManager credited full LP balance while Pool only debited the allowance, letting a lender loop memorializePositions to inflate position value ~1500x and over-claim rewards.

- Payout: Contest reward
- Severity: high
- Program: Ajna Protocol
- Credited: BPZ
- Disclosed: 2023-06-29
- Write-up quality: 8/10
- Original: https://github.com/code-423n4/2023-05-ajna-findings/issues/256
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-ajna%3AH-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** PositionManager.memorializePositions / Pool LP accounting
**Root cause:** memorializePositions adds the lender's entire pool LP balance to PositionManager state, but Pool.transferLP only debits min(allowance, balance), so a small allowance transfers little while the manager records the full balance.
**Steps:**
1. Add liquidity to buckets 2550-2552 (3000 each) and mint a PositionManager NFT.
2. Call `pool.increaseLPAllowance(positionManager, indexes, [1e18,1e18,1e18])` for only 1 token per bucket.
3. Call `positionManager.memorializePositions(tokenId, indexes)`; manager LP += full balance, pool LP -= only 1e18.
4. Repeat increaseLPAllowance + memorializePositions until pool LP balances reach 0.
5. Observe manager LP per bucket inflated to 4,501,500e18 from 3,000e18.
**How found:** Code-reading comparison of PositionManager.memorializePositions (adds full lpBalance) against Pool/LPActions.transferLP (debits min(allowance, balance)) revealed the accounting mismatch; confirmed with a Foundry loop test.
**Exploitation:** Lender loops the allowance/memorialize cycle to zero out real pool LP while PositionManager records exponentially inflated LP, then stakes the overvalued position in RewardsManager to claim excess AJNA rewards redeemable for quote tokens and inflate governance voting weight.
**Escalation:** Inflated LP also boosts AJNA-weighted voting power over proposal funding.
**Insight:** When two contracts track the same balance, compare the credit path against the debit path: any min()/allowance clamp on one side but not the other is a repeatable inflation primitive, especially where the credited value feeds a rewards or voting calculation.