# Stable swap pools don’t properly handle assets with different decimals, forcing LPs to receive wrong shares

MANTRA stable swap compute_d sums raw token amounts without decimal normalization, so LPs depositing high-decimal assets receive inflated LP shares.

- Payout: Audit contest
- Severity: high
- Program: MANTRA
- Credited: 0xAlix2
- Disclosed: 2025-03-31
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2024-11-mantra-dex#h-06
- Library page: https://bugbountylibrary.com/r/c4%3A2024-11-mantra-dex%3AH-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:regression technique:source-review vuln:accounting-error vuln:business-logic

**Target:** CosmWasm stable swap pool deposit / compute_d invariant
**Root cause:** compute_d sums deposit amounts in raw base units without normalizing per-asset decimals (Curve rate multipliers), so D is dominated by high-decimal tokens; compute_lp_mint_amount_for_stableswap_deposit uses this skewed D to mint shares.
**Steps:**
1. Create stable swap pool with uluna(6), uusd(6), uweth(18) decimals, amp=100.
2. Seed liquidity with 10e6 uluna, 10e6 uusd, 10e18 uweth.
3. Deposit 2e6 uluna + 2e18 uweth -> LP receives 13_901_163_096_216 shares.
4. Deposit 2e6 uluna + 2e6 uusd -> LP receives only 9_054_673_799_013 shares.
5. Observe disproportionate share minting for the 18-decimal asset deposit.
**How found:** Compared MANTRA's compute_d against Curve's stable swap rate-multiplier normalization; noticed compute_swap normalizes decimals but compute_d does not, then wrote integration tests with mixed 6/18 decimal assets to confirm share inflation.
**Exploitation:** Attacker deposits the high-decimal token into a stable swap pool; compute_d overweights it, minting excess LP shares that can be redeemed to drain value from other LPs.
**Insight:** When a protocol ports Curve/Aave-style invariant math, diff each helper against the original: normalization applied in swap paths is often forgotten in invariant/D computation, and mixed-decimal pools expose it via share-mint skew.