# Inaccurate swap amount calculation in ReLP leads to stuck tokens and lost liquidity

ReLP's swap-amount math for one-sided Uniswap V2 liquidity is imprecise, leaving dust WETH stuck in the contract and shrinking LP value after each reLP.

- Payout: Contest reward
- Severity: medium
- Program: Dopex
- Credited: degensec
- Disclosed: 2023-12-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-08-dopex-findings/issues/153
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AM-16
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:precision-loss

**Target:** ReLPContract reLP() Uniswap V2 liquidity rebalancing
**Root cause:** The WETH-to-RDPX swap amount is computed with an approximation rather than the exact one-sided-supply formula, so the swap overshoots/undershoots and residual WETH remains in ReLPContract after liquidity is re-added.
**Steps:**
1. Fork Arbitrum at block 24023149; deploy mock WETH/RDPX, RdpxReserve, MockUniV2Amo, MockRdpxV2Core, MockRdpxEthPriceOracle.
2. Create Uniswap V2 pair via factory 0xc35DADB65012eC5796536bD9864eD8773aBc74C4, router 0x1b02dA8Cb0d097eB8D57A175b88c7D8b47997506.
3. Add initial liquidity 100e18 RDPX / 30e18 WETH to amo; set oracle price 0.3e8; set reLpFactor 1e8.
4. Call `re.reLP(Math.sqrt(tokenAReserve) * 250000)`.
5. Observe after: amo LP drops, core receives 316227765999999999 RDPX, and 67290285273869 wei WETH remains stuck in ReLPContract.
**How found:** Author reasoned about the one-sided Uniswap V2 supply math (Alpha Venture DAO blog) and noticed ReLP's swap-amount calculation deviates from the exact formula, then built a Foundry fork PoC to measure residual WETH.
**Exploitation:** Any user can trigger reLP via RdpxV2Core bonding logic; repeated calls leave growing WETH dust in ReLPContract (recoverable only by another reLP), griefing the protocol and reducing LP value.
**Insight:** When a contract rebalances a Uniswap V2 position by swapping part of one side, compare its swap amount against the closed-form one-sided-supply formula; any approximation leaves deterministic dust that an unprivileged caller can repeatedly trigger.