# GTELaunchpadV2Pair::burn over-estimates distribution amounts when there are non-zero accrued launchpad fees

GTELaunchpadV2Pair.burn computes LP payout from balances that include accrued launchpad fees, letting an attacker mint/burn repeatedly to drain pair liquidity.

- Payout: Contest reward
- Severity: high
- Program: GTE
- Credited: hgrano
- Disclosed: 2026-02-05
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#h-03
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic

**Target:** GTELaunchpadV2Pair.sol (Uniswap V2-style LP pair)
**Root cause:** burn() computes amount0/amount1 from balance0/balance1, which include accrued launchpad fees owed to the distributor, while mint() uses reserves that exclude those fees. This mismatch gives LPs a claim on fees they don't own.
**Steps:**
1. Perform swap(s) so accruedLaunchpadFee0/1 are non-zero.
2. Call mint() to add liquidity; liquidity is computed from _reserve0/_reserve1 (fees excluded).
3. Call burn() to redeem LP tokens; payout uses balance0/balance1 (fees included), yielding more than deposited.
4. Repeat mint/burn to compound profit until pair liquidity is drained.
**How found:** Code review comparing mint() (uses _reserve0/_reserve1) against burn() (uses balance0/balance1); noticed balances include accrued launchpad fees that reserves exclude, creating an accounting mismatch exploitable by an LP.
**Exploitation:** Single-transaction loop: swap to accrue fees, mint LP at reserve-based rate, burn at balance-based rate to capture a share of accrued fees, repeat to siphon nearly all pair liquidity.
**Escalation:** Repeating the mint/burn cycle compounds the over-payment, scaling from a small profit to draining most of the pair's liquidity.
**Insight:** When auditing Uniswap V2 forks, diff the accounting basis of mint vs burn: any fork-added fee bucket (e.g. accrued protocol/launchpad fees) that lives in balances but not reserves creates a mint-low/burn-high arbitrage for LPs.