# Storage can be bloated with low value liquidity positions

Omnipool lets users add MinimumPoolLiquidity then withdraw all but 1 wei, leaving dust positions that bloat chain storage cheaply and risk DoS.

- Payout: Contest reward
- Severity: medium
- Program: HydraDX
- Credited: J4X
- Disclosed: 2024-04-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-hydradx-findings/issues/54
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-hydradx%3AM-08
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:rust technique:source-review vuln:business-logic vuln:dos

**Target:** Substrate pallet omnipool add_liquidity/remove_liquidity and Positions storage map
**Root cause:** add_liquidity enforces amount >= MinimumPoolLiquidity, but remove_liquidity only deletes the position when shares reach zero, allowing a position to be reduced to 1 wei while its storage entry persists.
**Steps:**
1. Call `Omnipool::add_liquidity(origin, asset_id, 1_000_000)` (exactly MinimumPoolLiquidity) to mint a position NFT and insert into `Positions`.
2. Call `Omnipool::remove_liquidity(origin, position_id, 1_000_000-1)` leaving amount=1, shares=1.
3. Observe `Positions::<Test>::get(position_id)` still returns a Position with amount 1, shares 1.
4. Repeat to create unlimited dust storage entries at ~1/1,000,000 of intended cost.
**How found:** Code reading of add_liquidity's MinimumPoolLiquidity check versus remove_liquidity's zero-shares-only deletion, noticing the asymmetry that permits a 1-wei residual position.
**Exploitation:** Attacker repeatedly adds MinimumPoolLiquidity and withdraws all but 1 wei, paying only gas/weight per iteration while forcing the chain to permanently maintain dust position storage entries, potentially bloating state until maintenance costs become unsustainable (DoS).
**Insight:** When a minimum deposit guards storage creation, check the withdrawal path for a matching minimum: partial withdrawals that leave a nonzero dust balance bypass the intended anti-bloat cost.