# Attacker can drain funds from GTELaunchPadV2Pair using swap

GTELaunchpadV2Pair swap infers input amounts from balances that include accrued launchpad fees, letting an attacker fake deposits and drain pair reserves.

- Payout: Contest reward
- Severity: high
- Program: GTE
- Credited: hgrano
- Disclosed: 2026-02-05
- Write-up quality: 8/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#h-04
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic

**Target:** GTELaunchpadV2Pair.sol swap/_update (Uniswap V2 fork pair)
**Root cause:** swap computes amountIn from raw balances while reserves are stored net of accrued launchpad fees, so the fee delta is misread as a user deposit; the k-invariant check uses the same inflated balances.
**Steps:**
1. Accrue non-zero launchpad fees on the pair so totalLaunchpadFee0/1 > 0 and reserves = balances - fees.
2. Call `swap(amount0Out = totalLaunchpadFee0 * 0.997, amount1Out = 0, to = attacker, data)` without transferring any tokens in.
3. Contract computes `amount0In = balance0 - (_reserve0 - amount0Out) = totalLaunchpadFee0`, falsely crediting a deposit.
4. k check passes because adjusted balances are inflated by accrued fees; attacker receives tokens for free.
5. Repeat swap in the same transaction/block before fees are cleared to drain up to 100% of pair tokens.
**How found:** Code review of _update reserve accounting vs swap's amountIn inference: noticed reserves exclude launchpad fees while balance0/balance1 include them, making the balance-delta deposit detection overstate input.
**Exploitation:** Attacker needs accrued launchpad fees present on the pair, then repeatedly calls swap with amountOut sized to the fee (minus 0.3%) and no prior transfer, extracting tokens each iteration within one transaction since reserves are recomputed as balances minus uncleared fees.
**Escalation:** Looping swap calls in a single transaction compounds the free extraction to drain the entire pair balance.
**Insight:** In Uniswap V2 forks, any accounting that stores reserves net of a fee while measuring deposits from raw balances creates a phantom-input bug; check every place reserves and balances are compared, including the k-invariant, for the same skew.