# DOS of Launchpad Graduation via addLiquidity with 1 Wei donation

Attacker donates 1 wei of quote token to a launchpad pair and calls sync(), making reserves one-sided so router addLiquidity reverts and graduation is DOSed.

- Payout: Contest reward
- Severity: high
- Program: GTE
- Credited: gizzy
- Disclosed: 2026-02-05
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#h-09
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AH-09
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** UniswapV2-style pair and router used by Launchpad graduation
**Root cause:** Attacker transfers 1 wei of quote token to the pair and calls sync(), setting reserves to (0, >0). UniswapV2Library.quote() requires both reserves > 0, so the router's addLiquidity reverts during _graduate().
**Steps:**
1. Identify a created token's target pair before graduation.
2. Send `IERC20(quoteToken).transfer(targetPair, 1 wei)`.
3. Call `IUniswapV2Pair(targetPair).sync()` to set reserves to (0, >0).
4. Trigger graduation: `uniV2Router.addLiquidity(...)` calls quote() which reverts with INSUFFICIENT_LIQUIDITY.
**How found:** Code-reading of Launchpad._graduate()'s reliance on the UniswapV2 router and the quote() reserve precondition, combined with the observation that sync() can be forced to one-sided reserves via a donation.
**Exploitation:** Front-run graduation by donating 1 wei of quote token to the pair and calling sync(), forcing one-sided reserves; the router's addLiquidity then reverts, blocking token launch completion.
**Insight:** When a contract delegates liquidity provisioning to a UniswapV2 router, an attacker can pre-poison pair reserves with a 1-wei donation plus sync(); check whether graduation/mint paths can bypass the router and call pair.mint() directly.