# Incorrect calculations in deposit() function in TokenisableRange.sol can make the users suffer from immediate loss

TokenisableRange.deposit() computes uncompounded fee from raw user inputs n0/n1 rather than the ratio-adjusted deposit amounts, so depositors lose fee value on immediate withdrawal.

- Payout: Contest reward
- Severity: medium
- Program: Good Entry
- Credited: 0xDING99YA
- Disclosed: 2023-10-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-08-goodentry-findings/issues/202
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-goodentry%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** TokenisableRange.sol deposit()/withdraw() LP accounting
**Root cause:** newFee0/newFee1 are derived from user-supplied n0/n1, which may not match the pool's current token ratio, while actual deposit and LP minting use the ratio-adjusted amounts, so the fee share credited differs from what was paid.
**Steps:**
1. Set state: n0=415, n1=100, fee0=20, fee1=5, token0Amount=4000, token1Amount=1000, L=1000, LP supply=2000.
2. deposit() enters fee branch: `newFee0 = n0*fee0/(token0Amount+fee0) = 415/201`, `newFee1 = n1*fee1/(token1Amount+fee1) = 100/201`.
3. n0 becomes 412.935, n1 becomes 20000/201; deposit mints newL=20000/201 and 40000/201 LP tokens.
4. Withdraw all LP: removedLiquidity=20000/201, fee0 returned = 1.9923 vs 2.0647 paid; fee1 returned exactly.
5. Observe net loss in fee0 due to ratio mismatch between input and actual deposit.
**How found:** Symmetry reasoning: a deposit followed immediately by withdrawal with no market change and no fees should return the same value; testing the deposit/withdraw round-trip with concrete numbers revealed the fee accounting asymmetry.
**Exploitation:** Not an attack; a user depositing at a token ratio differing from the pool ratio suffers an immediate uncompounded-fee loss on withdrawal. No external attacker extraction described.
**Insight:** When auditing LP/fee accounting, test round-trip symmetry (deposit then immediate withdraw) with inputs whose token ratio deliberately deviates from the pool ratio; fee deductions computed on raw inputs rather than ratio-normalized amounts leak value.