# twAML weights can be griefed by burning tokens

OTAP's open burn lets users destroy locked tokens, blocking exitPosition and permanently skewing twAML weights/discounts.

- Payout: Contest reward
- Severity: medium
- Program: Tapioca DAO
- Credited: carrotsmuggler
- Disclosed: 2024-05-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-tapioca-findings/issues/132
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-11
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:governance

**Target:** TOB/OTAP twAML voting-weight accounting
**Root cause:** OTAP.burn is callable by any owner, so a user can burn their locked OTAP before exitPosition; exitPosition then reverts on otap.burn, so twAML values are never reset.
**Steps:**
1. Lock liquidity in TOLP and mint OTAP in TOB with ybShares >= computeMinWeight to gain voting power.
2. Participate to shift pool.averageMagnitude, cumulative, totalDeposited for the sglAssetID.
3. Call `OTAP.burn(tokenId)` directly as owner to destroy the locked token.
4. After lock expiry, exitPosition/kick attempts call `otap.burn` and revert, leaving twAML skewed indefinitely.
**How found:** Noticed OTAP exposes an unrestricted burn while TOB's exit path relies on burning the same token; reasoned that pre-burning breaks the reset invariant that MAX_LOCK_DURATION otherwise bounds.
**Exploitation:** Attacker locks a minimal qualifying position, manipulates twAML magnitude/divergence to affect option exercise discounts, then burns OTAP so the pool state can never be unwound, permanently biasing discounts for that asset id.
**Insight:** When a protocol bounds state changes by lock duration, check whether the exit/reset path depends on a token or approval the user can destroy or revoke independently—pre-burning breaks the unwind.