# AuraSpell#openPositionFarm uses incorrect join type for balancer

AuraSpell.openPositionFarm passed empty userData to Balancer's joinPool, decoding to JoinKind.INIT (0) and reverting on already-initialized pools, blocking all farm position opens.

- Payout: Contest reward
- Severity: high
- Program: Blueberry
- Credited: 0x52
- Disclosed: 2023-04-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-blueberry-judging/issues/120
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AH-2
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** AuraSpell.openPositionFarm Balancer joinPool integration
**Root cause:** JoinPoolRequest.userData was set to empty bytes, which abi-decodes to enum value 0 = JoinKind.INIT instead of EXACT_TOKENS_IN_FOR_BPT_OUT (1).
**Steps:**
1. Call AuraSpell.openPositionFarm on an already-initialized Balancer pool
2. Spell builds JoinPoolRequest with userData = ""
3. Balancer _joinPoolSwitch decodes kind = 0 (INIT)
4. Init join on initialized pool reverts, blocking position open
**How found:** Code reading of Balancer's JoinKind enum and join switch, noticing empty userData decodes to INIT (0) rather than the intended exact-tokens-in join.
**Insight:** When integrating with Balancer, empty userData silently decodes to JoinKind.INIT; always encode the explicit join kind (e.g. abi.encode(uint256(1), amounts, minBpt)) and verify enum ordinal 0 semantics.