# Bonding WETH discounts can drain WETH reserves of RdpxV2Core contract to zero

Bonding WETH discounts are paid in rDPX while _stake always deducts _amount/2 WETH from reserves, draining RdpxV2Core WETH to zero and DoSing future mints.

- Payout: Contest reward
- Severity: medium
- Program: Dopex
- Credited: Toshii
- Disclosed: 2023-12-29
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-08-dopex-findings/issues/2210
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-01
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** RdpxV2Core.sol bond/_transfer/_stake
**Root cause:** WETH bonding discount is compensated in rDPX via extraRdpxToWithdraw, but _stake unconditionally subtracts _amount/2 WETH from reserveAsset WETH balance regardless of actual WETH deposited.
**Steps:**
1. Call `bond(_amount, 0, _to)` with rDPX reserves high so bondDiscount approaches 100e8.
2. calculateBondCost returns wethRequired as low as 25% of _amount (ETH_RATIO_PERCENTAGE 75e8 minus bondDiscount/2).
3. _transfer computes discountReceivedInWeth = _bondAmount - _wethAmount - rdpxAmountInWeth and withdraws equivalent rDPX from rdpxReserve instead of WETH.
4. _stake executes `reserveAsset[reservesIndex["WETH"]].tokenBalance -= _amount / 2`, pulling the missing WETH from contract reserves.
5. Repeat until WETH reserve balance reaches zero; subsequent bond calls revert, DoSing dpxETH minting.
**How found:** Code review of bond cost math: noticed discount can reach 2/3 of the 75% ETH ratio, then traced _transfer compensating discount in rDPX while _stake still debits _amount/2 WETH from reserves.
**Exploitation:** Attacker repeatedly bonds with rDPX while discounts are active, paying only the discounted WETH portion but forcing the contract to debit full _amount/2 WETH each time, siphoning reserve WETH into the dpxETH-WETH liquidity position until reserves are exhausted.
**Insight:** When a discount is applied to one asset but the downstream accounting debits a fixed fraction of a different asset, check whether the compensating leg actually replenishes the debited reserve; mismatched compensation currency is the tell.