# Omnipool does not take into account pending balancer protocol fees

Omnipool's BPT valuation ignores pending Balancer protocol fees in totalSupply, over-valuing BPT and under-minting LP tokens to depositors, causing up to 4% loss.

- Payout: Contest reward
- Severity: medium
- Program: Opal
- Credited: giraffe0x
- Disclosed: 2024-03-30
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_opal_feb2024.pdf#3.3.16
- Library page: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.16
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** Omnipool deposit/withdraw BPT valuation oracle
**Root cause:** BPT price is computed as TVL/totalSupply, but totalSupply excludes accrued Balancer protocol fees that will be minted on next join/exit, so BPT is over-valued and the pre-deposit underlying snapshot is inflated.
**Steps:**
1. Fork mainnet at block 19105677; deploy Omnipool with USDC/STG weighted Balancer pool.
2. Bob deposits 10 USDC to seed pool.
3. Loop 1000x swaps USDC->STG and STG->USDC to accrue large Balancer protocol fees.
4. Alice deposits 10 USDC; beforeTotalUnderlying uses stale totalSupply (missing pending fees) so BPT valuation is over-estimated.
5. Alice withdraws after 1 block; receives only ~9.6 USDC (4% loss) because LP tokens were under-minted.
**How found:** Reading Balancer joinPool semantics: protocol fees are minted to the fees collector before depositor BPT, so totalSupply used in BPT price is stale; traced Omnipool's beforeTotalUnderlying snapshot to confirm over-estimation.
**Exploitation:** Depositor loses value proportional to accrued pending protocol fees; attacker could instead deposit right after another user's deposit to avoid the loss, or sandwich to benefit from the mispricing.
**Insight:** When pricing LP/BPT shares from totalSupply, check whether the underlying pool mints pending protocol/management fees on join/exit; a stale totalSupply systematically misprices deposits and can be exploited by depositing after fee accrual or front-running fee-minting events.