# Attacker can DOS liquidity migration in LiquidityManager.sol

Attacker donates currency tokens to LiquidityManager, inflating computed agent token liquidity and causing ERC20InsufficientBalance revert, blocking migration.

- Payout: Contest reward
- Severity: medium
- Program: IQ AI
- Credited: 0xAsen
- Disclosed: 2025-03-19
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-01-iq-ai#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2025-01-iq-ai%3AM-02
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:dos

**Target:** LiquidityManager.sol moveLiquidity function
**Root cause:** moveLiquidity uses raw currencyToken.balanceOf(address(this)) to compute required agent token liquidity, which can be inflated by direct token transfers.
**Steps:**
1. Attacker transfers extra currency tokens directly to LiquidityManager contract via `currencyToken.transfer(address(manager), extraAmount)`.
2. This increases `currencyToken.balanceOf(address(this))` used in `moveLiquidity()`.
3. Computed `liquidityAmount = (currencyAmount * 1e18) / price` becomes larger than actual agent token balance.
4. Subsequent `agentToken.safeTransfer(address(fraxswapPair), liquidityAmount)` reverts with ERC20InsufficientBalance, blocking migration.
**How found:** Code review identified reliance on raw balanceOf for liquidity calculation, then tested with a coded PoC showing revert when donation exceeds available agent tokens.
**Exploitation:** Attacker donates a large amount of currency tokens (e.g., 10M IQ) to the LiquidityManager, causing the computed agent token liquidity to exceed the contract's balance, so the migration transaction reverts.
**Insight:** When a contract uses its own token balance to compute required amounts, direct donations can cause reverts; check for balance-dependent logic in migration or swap functions.