# addLiquidity Sandwich Attack for unbalanced token deposits

Basin Well's addLiquidity allows imbalanced deposits; attacker front-runs with large single-token deposit, victim deposits, attacker removes liquidity, stealing ~28% of victim funds.

- Payout: Contest reward
- Severity: medium
- Program: Basin
- Credited: Cosine
- Disclosed: 2023-10-05
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-basin-findings/issues/82
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-basin%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:oracle-manipulation

**Target:** Well.sol addLiquidity / removeLiquidityOneToken
**Root cause:** addLiquidity accepts imbalanced token ratios and mints LP based on current reserves; a large single-token deposit shifts the ratio so the victim's subsequent imbalanced deposit mints fewer LP tokens, which the attacker then redeems.
**Steps:**
1. Deploy Well with two tokens at balanced ratio.
2. Attacker front-runs: `tokens[0].approve(well, 1000e18)`; `well.addLiquidity([1000e18, 0], 0, attacker, max)`.
3. Victim calls `well.addLiquidity([100e18, 0], 0, victim, max)`.
4. Attacker calls `well.removeLiquidityOneToken(lpBalance, tokens[0], 1, attacker, max)`.
5. Attacker's token[0] gain exceeds 28% of victim's deposit.
**How found:** Researcher reasoned that imbalanced liquidity provision is allowed and that LP minting depends on current reserves, then wrote a Foundry PoC sandwiching a single-token deposit.
**Exploitation:** Attacker observes victim's pending imbalanced addLiquidity, front-runs with a much larger single-token deposit to skew reserves, lets victim deposit at the worse ratio, then immediately removes liquidity to capture the value difference. No fees in Well make it more profitable.
**Escalation:** Profit scales with attacker deposit size relative to victim deposit; can be repeated.
**Insight:** In AMMs that permit imbalanced liquidity adds, check whether LP minting uses spot reserves; a large one-sided deposit before a victim's one-sided deposit shifts the ratio and lets the attacker redeem the victim's value. Test with minLpAmountOut=0 to expose missing slippage.