# Router does not check if Exact Out Single Swap was partial leading to unexpected results for the users

Ekubo Router's single exact-out swap only checks max input, so partial fills succeed, delivering less output than the user requested.

- Payout: Contest reward
- Severity: medium
- Program: Ekubo
- Credited: hakunamatata
- Disclosed: 2026-01-12
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-11-ekubo#m-04
- Library page: https://bugbountylibrary.com/r/c4%3A2025-11-ekubo%3AM-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** Router.sol single-hop exact-out swap
**Root cause:** For single exact-out swaps the router only validates amountIn <= maximumAmountOfTokenInToPay and never checks that the full requested output was delivered, so a partial fill (insufficient liquidity or restrictive sqrtRatioLimit) still passes.
**Steps:**
1. Call Router single-hop exact-out swap with desired output amount and maximumAmountOfTokenInToPay.
2. Pool cannot fill full output due to liquidity or sqrtRatioLimit, returns smaller output and smaller input.
3. Router checks only amountIn <= max, passes, transaction succeeds with less output than requested.
**How found:** Code review of Router.sol swap validation comparing exact-in (checks min output) vs exact-out (checks only max input), spotting the missing full-fill check for single exact-out swaps.
**Insight:** When auditing swap routers, compare validation symmetry across all four modes (single/multi × exact-in/exact-out); exact-out paths must assert the full output was received, not just that input stayed under the cap.