# `getAdjustedLongAndShortTokenAmounts()` Incorrectly Calculates Amounts

getAdjustedLongAndShortTokenAmounts compares diff against poolLongTokenAmount instead of longTokenAmount, causing overflow reverts or unbalanced long/short pool deposits in GMX.

- Payout: Contest reward
- Severity: medium
- Program: Gmx
- Credited: IllIllI
- Disclosed: 2022-09-22
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-gmx-judging/issues/72
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-gmx%3AM-35
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** ExecuteDepositUtils.sol deposit balancing logic
**Root cause:** The if-statements compare diff against poolLongTokenAmount/poolShortTokenAmount instead of the user's longTokenAmount, so the branch chosen is wrong for many inputs.
**Steps:**
1. Read getAdjustedLongAndShortTokenAmounts in ExecuteDepositUtils.sol lines 381-414.
2. Note line 395 compares `diff < poolLongTokenAmount` rather than `diff < longTokenAmount`.
3. Case diff < poolLongTokenAmount and longTokenAmount < diff: line 396 underflows, reverting the deposit.
4. Case diff >= poolLongTokenAmount and longTokenAmount >= diff: too many tokens attributed to long, unbalanced pool.
5. Same bug at line 404 for the short-deficit branch.
6. Initial deposit with diff=0 and zero pools hits lines 408-409, attributing all funds to short and none to long.
**How found:** Manual code review of the deposit balancing function, checking each branch's comparison variables against the intended semantics of reducing pool imbalance.
**Exploitation:** Attacker/depositor triggers a deposit into a same-token market; depending on pool state the tx reverts (DoS) or the deposit is misallocated, producing significant price impact and an unbalanced pool, notably on the first deposit.
**Insight:** In balancing/accounting functions, verify each conditional compares against the user-supplied amount, not the pool state variable; test the zero-state initial deposit as an edge case where diff=0 forces the else branch.