# Attacker can amplify a rounding error in MagicLP to break the I invariant and cause malicious pricing

Rounding in MagicLP buyShares lets attacker skew _QUOTE_TARGET_ so pool ratio doubles from I, mispricing trades and harming traders.

- Payout: Contest reward
- Severity: high
- Program: Abracadabra Money
- Credited: Trust
- Disclosed: 2024-05-03
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-03-abracadabra-money-findings/issues/221
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:precision-loss

**Target:** MagicLP AMM pool buyShares / PMM pricing
**Root cause:** buyShares uses mulFloor in the quoteBalance < mulFloor(baseBalance,_I_) comparison, so a floor-rounded equality takes the baseBalance branch and sets _QUOTE_TARGET_ = mulFloor(shares,_I_), magnifying rounding into a wrong target ratio.
**Steps:**
1. Create/init pool with I=1e14, baseBalance=19999, quoteBalance=1.
2. buyShares: 1 < mulFloor(19999,1e14)=1 is false, so shares=baseBalance=19999.
3. _QUOTE_TARGET_ = mulFloor(19999,1e14)=1, giving ratio 1:19999 instead of intended 1:1000.
4. Victim calls sellBase; getPMMState uses compromised _QUOTE_TARGET_ (R==ONE, no adjustedTarget fix).
5. _ROneSellBaseToken -> _SolveQuadraticFunctionForTrade(state.Q0,...) prices trade off wrong Q0, victim receives incorrect quote.
**How found:** Code-reading of buyShares initial-supply branch; noticed mulFloor in the comparison can make the inequality false at equality, taking the baseBalance branch and magnifying rounding into the target ratio.
**Exploitation:** Attacker initializes a pool (own or freshly created by another) with tiny amounts chosen so floor rounding flips the branch, setting a skewed _QUOTE_TARGET_. Traders trusting the Factory-enforced I ratio then trade at wrong prices, losing funds to the mispriced pool.
**Insight:** In AMM init math, check whether floor/ceil rounding in a branch-selection comparison can flip which branch executes; a floor-rounded equality silently picks the wrong branch and the error propagates into stored target reserves used by the pricer.