# MergeTgt has no handling if TGTTOEXCHANGE is exceeded during the exchange period

MergeTgt lacks a cap on deposited TGT, so once TGTTOEXCHANGE is exceeded, later claimers cannot claim TITN and withdrawRemainingTitn underflows.

- Payout: Contest reward
- Severity: high
- Program: THORWallet
- Credited: jsonDoge
- Disclosed: 2025-04-15
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-02-thorwallet#h-1
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-thorwallet%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** MergeTgt.sol merge/claim contract
**Root cause:** MergeTgt hardcodes TGTTOEXCHANGE/TITNARB for rate and TITN deposit but never enforces a cap on total TGT deposited, so claimable TITN can exceed the contract's actual TITN balance; withdrawRemainingTitn then underflows.
**Steps:**
1. Deploy Tgt with supply > 579,000,000 and MergeTgt with 173,700,000 TITN deposited.
2. user1 transferAndCall 578,999,999 TGT to MergeTgt; user2 deposits 100 TGT.
3. user2 claims claimableTitnPerUser successfully.
4. user1 calls claimTitn(173699999700000000000000000) -> reverts ERC20InsufficientBalance since contract holds only 173,699,970,000,000,000,000,000,000.
5. Later withdrawRemainingTitn computes `remainingTitnAfter1Year - initialTotalClaimable` which underflows.
**How found:** Code reading of MergeTgt's hardcoded TGTTOEXCHANGE/TITNARB constants revealed no deposit cap; on-chain TGT supply (447M ARB + 897M ETH) exceeds 579M, making the overflow reachable; PoC test confirmed claim revert.
**Insight:** When a contract hardcodes a conversion ratio and pre-funds a fixed token amount, check whether the input side is actually capped — otherwise claimable output can exceed the funded balance and cause reverts/underflow on the last claimers.