# collateralizeWLp can be bypassed even when collateralization is paused

Paused collateralization bypassed: attacker donates LP tokens directly to a tokenId, inflating wLP balanceOfLp credit without calling collateralizeWLp.

- Payout: Contest reward
- Severity: medium
- Program: INIT Capital
- Credited: said
- Disclosed: 2024-01-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-initcapital-findings/issues/25
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AM-05
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** InitCore collateralizeWLp / PosManager wLP accounting
**Root cause:** Collateral credit for wLP is derived from the live balanceOfLp of the LP tokenId rather than internal accounting recorded at collateralize time, so external donations increase credited collateral.
**Steps:**
1. Admin pauses mode via canCollateralize=false, blocking collateralizeWLp.
2. Attacker obtains the LP tokenId already registered as collateral for a position.
3. Attacker transfers/donates LP tokens directly to that tokenId on the DEX (e.g. Uniswap allows adding liquidity to any position).
4. getPosCollInfo reads balanceOfLp(tokenId), which now includes the donation.
5. getCollateralCreditCurrent_e36 credits the inflated amount, bypassing the pause.
**How found:** Code reading: noticed collateralizeWLp enforces canCollateralize but credit computation reads live balanceOfLp instead of stored amounts, and that DEXs permit third-party liquidity additions to any position.
**Exploitation:** Directly donate LP tokens to a collateralized tokenId; the position's collateral credit rises without any collateralizeWLp call, defeating the admin pause and enabling additional borrowing against unaccounted collateral.
**Insight:** When a pause gates a deposit function, check whether downstream accounting reads live token balances (balanceOf/balanceOfLp) rather than stored amounts—external transfers can then bypass the gate entirely.