# MinShares Slippage Parameters Are Ineffective For Initial Deposit

Salty AMM mints initial liquidity as x+y instead of sqrt(x*y), letting a frontrunner inflate shares so minShares slippage fails and first depositor loses most tokens.

- Payout: Contest reward
- Severity: medium
- Program: Salty.IO
- Credited: Banditx0x
- Disclosed: 2024-04-19
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-01-salty-findings/issues/221
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-salty%3AM-28
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation vuln:share-inflation

**Target:** AMM liquidity pool _addLiquidity initial deposit
**Root cause:** Initial liquidity shares are computed as (x + y) rather than sqrt(x*y), making share minting path-dependent and manipulable by a prior deposit.
**Steps:**
1. Attacker frontruns first depositor with imbalanced deposit, e.g. `1e2 USDT` and `1e18 DAI`, setting `x*y = 1e20` and minting inflated shares via x+y.
2. Attacker rebalances reserves to equal ratio (e.g. `1e10`/`1e10`) so each share represents tiny token amounts.
3. Victim deposits `1e22` of each token; mints ~`1e30` shares instead of `1e22`, far exceeding their minShares.
4. Attacker skews exchange rate (e.g. 1 DAI = 5 USDT) so victim's shares still clear minShares while attacker arbitrages the mispriced pool.
**How found:** Compared Salty's initial liquidity formula (x+y) against Uniswap v2's sqrt(x*y); recognized Uniswap's is path-independent while Salty's is not, so a prior deposit changes shares minted for the same token ratio, defeating minShares.
**Exploitation:** Frontrunner seeds pool at imbalanced ratio to inflate share count, rebalances to equal reserves, lets victim deposit at inflated share-per-wei rate, then skews the reserve ratio and arbitrages the pool, extracting value from the first depositor.
**Insight:** When auditing AMM deposit logic, check whether share minting is path-independent; any formula other than sqrt(x*y) for initial liquidity lets a frontrunner inflate shares and bypass minShares-style slippage guards.