# Unsynchronized LaunchpadLPVault address leading to Loss of fee to Stakers of new launchPad token

Launchpad's mutable launchpadLPVault desyncs from the factory's immutable launchpadLp, so new pairs compute fees against the old vault and accrue zero staker fees.

- Payout: Contest reward
- Severity: medium
- Program: GTE
- Credited: gizzy
- Disclosed: 2026-02-05
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#m-19
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-19
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:accounting-error vuln:misconfiguration vuln:reward-distribution

**Target:** Launchpad.sol / GTELaunchpadV2PairFactory / GTELaunchpadV2Pair
**Root cause:** Launchpad.launchpadLPVault is owner-updatable, but GTELaunchpadV2PairFactory.launchpadLp is immutable and baked into each pair's fee math; after an update, new pairs reference the stale vault while LP tokens are sent to the new vault.
**Steps:**
1. Owner calls `updateLaunchpadLPVault(newVault)` on Launchpad, changing launchpadLPVault.
2. Factory's immutable launchpadLp still points to old vault; new pairs store old launchpadLp.
3. Launchpad creates a new pair and calls `uniV2Router.addLiquidity(... to: address(launchpadLPVault))`, sending LP to new vault.
4. Pair computes `launchpadLpBal = this.balanceOf(launchpadLp) + MINIMUM_LIQUIDITY` against old vault, which holds no LP, yielding zero fee share.
**How found:** Code reading: noticed factory launchpadLp is immutable while Launchpad.launchpadLPVault is mutable, then traced that pair fee calc uses the factory value while addLiquidity sends LP to the mutable vault.
**Exploitation:** Not an attacker-driven exploit; a configuration desync triggered by legitimate owner vault rotation causes all newly created pairs to accrue zero launchpad fee share to stakers.
**Insight:** When auditing fee/reward accounting, cross-check every address used in fee math against where the actual tokens are sent; mutable config on one contract vs immutable copy on another is a classic desync that silently zeroes rewards.