# Miscalculation in addLiquidity of Router results in unauthorized spending of tokens

Abracadabra Router's addLiquidity miscalculates adjusted amounts by reversing balanceOf and getReserves, letting an attacker donate tokens to force victims to spend more than intended.

- Payout: Contest reward
- Severity: medium
- Program: Abracadabra Money
- Credited: Trust
- Disclosed: 2024-05-03
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-03-abracadabra-money-findings/issues/231
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-abracadabra-money%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** Router.addLiquidity and previewAddLiquidity in Abracadabra Money contracts
**Root cause:** The adjustment logic computes requested amount as balance + amount - reserve instead of reserve + amount - balance, reversing the intended delta calculation.
**Steps:**
1. MagicLP has 500 USDC and 500 DAI reserves/balances, 100 shares.
2. Victim calls `addLiquidity(lp, to, 1000e18, 1000e18, 200, deadline)`.
3. Attacker frontruns and donates 1000 USDC and 500 DAI to the LP.
4. addLiquidity computes baseInAmount = 1500 + 1000 - 500 = 2000 USDC, quoteInAmount = 1000 + 1000 - 500 = 1500 DAI.
5. Ratios: baseIncreaseRatio = 2000/500 = 4, quoteIncreaseRatio = 1500/500 = 3.
6. Adjusted amounts: quoteAdjustedInAmount = 1500 DAI, baseAdjustedInAmount = 500 * 3 = 1500 USDC.
7. LP::buyShares() called with (1500, 1500) for 200 shares instead of (1000, 1000), forcing victim to spend extra 500 USDC and 500 DAI.
**How found:** Code review of the _adjustAddLiquidity function revealed that balanceOf and getReserves were used in the wrong order compared to the intended delta calculation.
**Exploitation:** Attacker donates tokens to the MagicLP before the victim's addLiquidity transaction, inflating the balance used in the miscalculation. The victim's transaction then transfers more tokens than specified, depositing unauthorized funds into the LP.
**Insight:** When reviewing liquidity addition logic, verify that balance and reserve values are used in the correct order to compute the delta; a reversed subtraction can allow donation-based griefing to force excess spending.