# Stable pool rewards can get overinflated if the tokens have different decimals

Stable pool liquidity calculator omitted decimal scaling in get_dy, overinflating stable pool liquidity and rewards versus standard pools with same tokens.

- Payout: Contest reward
- Severity: medium
- Program: Aquarius
- Credited: imsrybr0
- Disclosed: 2025-09-01
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_aquarius_aug2025.pdf#3.2.4
- Library page: https://bugbountylibrary.com/r/cantina%3Aaquarius_aug2025%3A3.2.4
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:solidity technique:incomplete-fix technique:source-review vuln:accounting-error vuln:precision-loss vuln:reward-distribution

**Target:** Soroban stableswap liquidity calculator contract (get_dy)
**Root cause:** The stableswap pool's get_dy was updated to scale dx/dy by precision_mul for differing token decimals, but the liquidity_pool_liquidity_calculator's get_dy copy was not updated, so liquidity is computed on unscaled reserves.
**Steps:**
1. Deploy two tokens with different decimals (e.g. 7 and 8) via CustomToken.
2. Init a standard pool and a stableswap pool with the same token pair.
3. Deposit equal amounts into both pools.
4. config_global_rewards, fill_liquidity, then config_pool_rewards for both pools.
5. jump 60 ledgers and compare get_liquidity and get_total_accumulated_reward for both pools.
6. Observe stable pool liquidity 17512522990 vs standard 3375157890 (mismatch vs same-decimals baseline).
**How found:** Reviewer noticed the stableswap contract's get_dy had been changed to apply precision_mul for decimal differences, then checked the liquidity calculator's duplicated get_dy and saw the scaling was absent, hypothesizing liquidity/reward misallocation.
**Exploitation:** Attacker deposits into a stableswap pool pairing tokens of differing decimals; the unscaled liquidity calculation inflates that pool's reported liquidity, so config_pool_rewards allocates it a disproportionate share of reward TPS at the expense of standard pools using the same tokens.
**Insight:** When a fix is applied to one copy of duplicated math (pool vs. liquidity calculator), diff the sibling implementation for the same scaling; reward-weighting logic that consumes pool liquidity is a high-leverage place for decimal/precision drift.