# Wrong rounding direction in DurationRemaining leads to value loss from TWAMM extension and Temporarily Freezing of a Pool

TWAMM extension rounds up refunds on order cancellation, allowing 1 wei over-refund per order; splitting into many orders drains balance and freezes pool.

- Payout: Contest reward
- Severity: medium
- Program: Ekubo
- Credited: jonah1005
- Disclosed: 2026-01-12
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-11-ekubo#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2025-11-ekubo%3AM-03
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** TWAMM extension smart contract
**Root cause:** In handleForwardData, remainingSellAmount is computed with roundUp: true instead of false, causing over-refund on order cancellation.
**Steps:**
1. Create a TWAMM pool with a position.
2. Mint 256 small orders with saleRate 28633115306 and amount 1 each.
3. Mint a second order to ensure refund transactions can execute.
4. Warp to time 511 and cancel all 256 orders via decreaseSaleRate.
5. Each cancellation over-refunds by ~1 wei due to rounding up.
6. Advance time and attempt any swap; it reverts with SavedBalanceOverflow, freezing the pool.
**How found:** Code review of rounding directions in TWAMM.sol; noticed inconsistency between roundUp in swap vs refund calculations.
**Exploitation:** Attacker creates many small orders, cancels them before expiry to accumulate over-refunds, draining the extension's saved balance. Subsequent swaps revert due to insufficient balance, freezing the pool. Alternatively, in a self-created pool, attacker can repeatedly steal 1 wei per interaction.
**Escalation:** Accumulated rounding errors lead to pool freeze (DoS) or economic profit on low-decimal high-value tokens.
**Insight:** When auditing DeFi protocols, check rounding directions in refund/cancellation logic; splitting orders can amplify rounding errors to drain balances or cause DoS.