# _getdepositpool() and _getwithdrawpool() can halt deposits and withdrawals for an om- nipool

Opal Omnipool's pool-selection loops skip pools at exact target allocation, so once all pools hit target, deposits and withdrawals revert, halting the omnipool.

- Payout: Contest reward
- Severity: medium
- Program: Opal
- Credited: 0xJaeger
- Disclosed: 2024-03-30
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_opal_feb2024.pdf#3.3.22
- Library page: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.3.22
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Omnipool.sol deposit/withdraw pool selection (_getDepositPool/_getWithdrawPool)
**Root cause:** Selection loops use `>=`/`<=` to skip pools at or past target allocation; when every pool sits exactly at target, no index is selected and the function reverts.
**Steps:**
1. Deploy omnipool with two underlying pools, target weights 50/50.
2. User1 deposits 500 tokens -> allocated to pool 1.
3. User2 deposits 500 tokens -> pool 1 at target, allocated to pool 2.
4. Both pools now exactly at target allocation.
5. User3 deposit reverts in `_getDepositPool()` (no pool index selected).
6. User4 withdraw reverts in `_getWithdrawPool()` (no pool index selected).
**How found:** Code review of the allocation-selection loops; noticed the equality boundary (`>=`/`<=`) excludes pools sitting exactly at target, so a fully-balanced state yields no candidate.
**Exploitation:** Attacker with minimal capital deposits into a freshly deployed omnipool to push every underlying pool to its exact target allocation, after which all deposits and withdrawals revert until a Liquidity Allocation Vote adjusts weights (min ~2 weeks).
**Insight:** In allocation/round-robin selection loops, test the exact-boundary state where every candidate equals its target: strict vs non-strict comparisons can leave zero eligible candidates and revert the whole flow.