# complete liquidity removal will result in permanent disable of the liquidity addition and prevent minting shares for the liquidity providers.

Removing all liquidity from an Omnipool asset zeroes reserve and shares, so add_liquidity divides by zero and permanently reverts, bricking the pool.

- Payout: Contest reward
- Severity: medium
- Program: HydraDX
- Credited: castle\_chain
- Disclosed: 2024-04-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-hydradx-findings/issues/75
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-hydradx%3AM-06
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:rust technique:source-review vuln:business-logic vuln:dos

**Target:** Substrate omnipool pallet (remove_liquidity/add_liquidity)
**Root cause:** remove_liquidity permits burning all shares, leaving asset_reserve and shares at zero; calculate_add_liquidity_state_changes then divides by reserve_hp (zero) and overflows, so add_liquidity always reverts.
**Steps:**
1. Add token via add_token, minting initial shares to position owner.
2. Position owner calls `remove_liquidity(origin, position_id, full_amount)` burning all shares; asset state becomes reserve=0, shares=0.
3. Any LP calls `add_liquidity(origin, asset_id, amount)`; `delta_shares_hp = shares_hp * amount_hp / reserve_hp` divides by zero -> ArithmeticError::Overflow revert.
4. Variant: attacker transfers 1 unit of asset to pool account after full removal; add_liquidity then succeeds but mints 0 shares, locking LP funds.
**How found:** Code reading of remove_liquidity allowing full share burn, then tracing calculate_add_liquidity_state_changes division by reserve_hp to spot the zero-reserve edge case; confirmed with a Rust unit test asserting ArithmeticError::Overflow.
**Exploitation:** Initial liquidity provider (or any holder of all shares) withdraws entire position, leaving pool with zero reserve/shares; subsequent add_liquidity calls revert permanently, disabling liquidity provision and trading for that asset. Alternatively donate 1 unit to make add_liquidity mint zero shares, locking depositor funds.
**Insight:** In AMM share math, check whether full withdrawal is permitted and whether the mint formula handles reserve==0; a zero-reserve pool either reverts on division or mints zero shares, both bricking or locking funds.