# GTELaunchpadV2Pair permits minting LP tokens for free when there are non-zero accumulated launch pad fees

GTELaunchpadV2Pair.mint computes deposited amounts as balance minus reserve, which excludes accrued launchpad fees, letting anyone mint LP tokens for free and burn to drain the pair.

- Payout: Contest reward
- Severity: high
- Program: GTE
- Credited: hgrano
- Disclosed: 2026-02-05
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#h-05
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:share-inflation

**Target:** GTELaunchpadV2Pair.sol mint/_update (Uniswap V2 fork pair)
**Root cause:** mint derives amount0/amount1 from balanceOf minus reserve, but _update sets reserve = balance - totalLaunchpadFee, so accrued fees are counted as newly deposited tokens.
**Steps:**
1. Accumulate non-zero totalLaunchpadFee0 and totalLaunchpadFee1 in the pair (fees received).
2. In the same block, call `mint(to)` directly on the pair without transferring any tokens.
3. mint computes amount0 = balance0 - _reserve0 = totalLaunchpadFee0 (and same for token1), treating fees as deposit.
4. LP tokens are minted for free; repeat mint within the block to inflate LP balance.
5. Call `burn(to)` to redeem LP for underlying tokens, draining the pair.
**How found:** Code reading of mint vs _update: noticed reserve excludes totalLaunchpadFee while mint uses balance-reserve as deposit amount, creating a mismatch exploitable when fees are non-zero.
**Exploitation:** Attacker waits for launchpad fees to accrue, then within the same block repeatedly calls mint (no token transfer needed) to mint LP shares backed by the fee balance, then burns to withdraw real reserves.
**Escalation:** Repeated mint calls in one block scale the stolen LP amount, potentially draining all pair funds.
**Insight:** In Uniswap V2 forks, any accounting that subtracts accrued fees from reserves breaks the balance-reserve deposit invariant in mint/sync; check every place reserve is compared to balanceOf for fee-adjusted skew.