# A user can bypass bandwidth limit by repeatedly "balancing" the pool

Ulysses AMM bandwidth withdrawal cap bypassed by repeatedly adding/removing small LP to rebalance diff/weight ratios, letting attacker drain nearly all pool liquidity.

- Payout: Contest reward
- Severity: high
- Program: Maia DAO Ecosystem
- Credited: xuwinnie
- Disclosed: 2023-09-18
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/392
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-20
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained vuln:accounting-error vuln:business-logic

**Target:** Ulysses AMM cross-chain liquidity pool (ulyssesAddLP/ulyssesRemoveLP, swap bandwidth accounting)
**Root cause:** LP add/remove distributes liquidity proportionally to diff before weight, so repeated small add/remove cycles converge diff/weight to a constant across destinations, making currentBandwidth proportional to weight and inflating the capped chain's bandwidth.
**Steps:**
1. Identify a pool where one chain's bandwidth is nearly exhausted (e.g. Avalanche:2 of target 30).
2. Swap a tiny amount (0.1 bnb-hETH) to obtain tokens usable for balancing.
3. Repeatedly `ulyssesAddLP(t)` then `ulyssesRemoveLP(t)` with small t to rebalance diff/weight ratios, shifting bandwidths (e.g. to mainnet:24, Avalanche:18, Linea:12).
4. Swap out a large amount (14 bnb-hETH) now permitted by inflated Avalanche bandwidth.
5. Repeat balance-and-swap cycle to drain nearly all pool liquidity.
**How found:** Reasoned about how ulyssesAddLP/RemoveLP distribute liquidity proportional to diff then weight; hypothesized that tiny repeated add/remove cycles drive diff/weight to a constant, making bandwidth proportional to weight and defeating the cap.
**Exploitation:** Attacker with funds on a healthy chain swaps small amounts and cycles add/remove LP to repeatedly rebalance the pool, inflating the bandwidth of the exploited chain, then swaps out large amounts of the capped asset, extracting nearly all available liquidity and causing unbounded LP loss.
**Escalation:** Repeating the balance-then-swap cycle scales extraction until the pool is drained.
**Insight:** When a cap is enforced via a state variable that LP add/remove operations mutate proportionally, check whether small repeated add/remove cycles can converge that state to a favorable ratio and inflate the cap.