# An attacker can exploit the "deposit" to drain the Ulysess Liquidity Pool

UlyssesPool.deposit approximates shares from amount, ignoring rebalancing fees minted, letting attackers repeatedly deposit to drain the pool.

- Payout: Contest reward
- Severity: high
- Program: Maia DAO Ecosystem
- Credited: xuwinnie
- Disclosed: 2023-09-18
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/435
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-19
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:fuzzing technique:source-review vuln:accounting-error vuln:business-logic

**Target:** UlyssesPool deposit/mint/redeem AMM liquidity functions
**Root cause:** deposit simulates state A->B to derive fees but actual state is B' with extra posFee shares minted; the approximation of shares from amount ignores rebalancing-fee share minting, so sum(pos')-sum(neg') can be less than sum(pos)-sum(neg).
**Steps:**
1. Set pool state: totalSupply=1000000000000000013287555072, weights=[1,59,47], bandwidths=[99452334745147595191585509,4253569467850027815346666,216725069177793291903286517].
2. Call `deposit(10000000, attacker)`; receive 36215776 shares.
3. Observe rebalancingFee delta: index1 +37038533, index2 -46828912, net pool worsens.
4. Repeat: search states where sum(pos')-sum(neg') < sum(pos)-sum(neg) via mint/redeem/swap to reach target state, then deposit to extract value.
5. Iterate until pool drained.
**How found:** Reasoned that mint computes share->amount precisely but deposit computes amount->share via approximation; hypothesized the simulated fee (posFee,negFee) diverges from actual (posFee',negFee') when posFee is large relative to supply; validated with Python random search for states where sum(pos')-sum(neg') < sum(pos)-sum(neg).
**Exploitation:** Attacker manipulates pool bandwidth state using mint/redeem/swap (which pay exact fee deltas), then calls deposit which overpays shares relative to fee delta, profiting each cycle and progressively draining underlying liquidity.
**Escalation:** Repeated deposit cycles across constructed states compound the leak until full pool drain.
**Insight:** When a contract offers both directions of a conversion (amount->share and share->amount), check whether the inverse path re-derives fees from a simulated state that omits shares minted by the fee itself; fuzz for states where the simulated fee delta exceeds the actual delta.