# Incorrect WETH Deposit in wrapAndDepositWETH Function leads to loss of funds

wrapAndDepositWETH reads address(this).balance after IWETH9.deposit, crediting 0 WETH to the user and permanently locking their wrapped ETH in the periphery contract.

- Payout: Contest reward
- Severity: high
- Program: InfinityPools
- Credited: Spearmint
- Disclosed: 2025-01-13
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_infinitypools_october2024.pdf#3.1.3
- Library page: https://bugbountylibrary.com/r/cantina%3Ainfinitypools_october2024%3A3.1.3
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** InfinityPoolsPeriphery.wrapAndDepositWETH (Solidity contract)
**Root cause:** The function calls IWETH9.deposit{value: address(this).balance}() then re-reads address(this).balance for the _depositERC20 amount; after the deposit the contract's ETH balance is 0, so 0 WETH is credited.
**Steps:**
1. Alice calls addLiquidity{value:10e18} on WETH/token1 pool; 1e19 ETH remains as excess in periphery.
2. Alice calls `infinityPoolsPeriphery.wrapAndDepositWETH(alice)`.
3. Function wraps the ETH via IWETH9.deposit, then reads address(this).balance (now 0) and calls `_depositERC20(WETH9, alice, 0)`.
4. Assert `infinityPoolsPeriphery.deposits(alice, WETH) == 0` while `WETH.balanceOf(periphery) == 1e19` — funds locked.
**How found:** Code review of the wrapAndDepositWETH helper: noticed address(this).balance is read after the deposit call, meaning the balance is already zeroed when used as the credit amount.
**Exploitation:** Any user with leftover ETH in the periphery after addLiquidity calls wrapAndDepositWETH; their ETH is converted to WETH but credited as 0, leaving the WETH stranded in the contract with no accounting entry.
**Insight:** When a helper wraps native ETH then credits an internal balance, check whether the amount is captured before the external deposit call — reading address(this).balance after a value-moving call silently yields 0.