# Calculation for directionMask is incorrect

LamboRebalanceOnUniwap assumes WETH is always Uniswap token1, so directionMask can be inverted, causing rebalance swaps in the wrong direction and financial loss.

- Payout: Contest reward
- Severity: high
- Program: Lambo.win
- Credited: 0xleadwizard
- Disclosed: 2025-02-03
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-lambowin#h-03
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-lambowin%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LamboRebalanceOnUniwap.sol _getQuoteAndDirection / OKX swap direction mask
**Root cause:** directionMask is derived from whether tokenIn equals weth rather than comparing tokenIn to the pool's actual token0/token1, but Uniswap orders tokens lexicographically by address, so WETH may be token0.
**Steps:**
1. Read `_getQuoteAndDirection` at LamboRebalanceOnUniwap.sol#L165: `directionMask = (tokenIn == weth) ? _BUY_MASK : _SELL_MASK;`
2. Note UniswapV3 sorts token0/token1 by address, not logical role; WETH can be token0.
3. Construct pool where WETH address < vETH address so token0=WETH, token1=vETH, with more vETH than WETH.
4. `_getTokenInOut` returns tokenIn=WETH; code sets _BUY_MASK (one-for-zero) though correct direction is zero-for-one.
5. Pass resulting directionMask to OKX swap via `rebalance`, executing swap in wrong direction.
**How found:** Code review of the direction-mask derivation; noticed the hardcoded assumption that WETH is token1, contradicting Uniswap's lexicographic token ordering.
**Exploitation:** Off-chain `previewRebalance` computes an inverted directionMask; when `rebalance` submits it to OKX, the swap executes one-for-zero instead of zero-for-one, moving the pool price the wrong way and causing financial loss to the protocol.
**Insight:** When integrating with Uniswap-style pools, never assume a token's index from its identity; always read token0()/token1() and map direction from actual pool ordering, especially when encoding direction bits for external routers.