# UserData for balancer pool exits is malformed and will permanently trap users

AuraSpell passes empty UserData to Balancer exitPool, decoding as EXACT_BPT_IN_FOR_ONE_TOKEN_OUT with missing fields, so all withdrawals revert and trap users.

- Payout: Contest reward
- Severity: high
- Program: Blueberry
- Credited: 0x52
- Disclosed: 2023-04-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-blueberry-judging/issues/129
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AH-8
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** AuraSpell.sol Balancer exitPool integration
**Root cause:** exitPool is called with UserData="", which Balancer decodes as ExitKind 0 (EXACT_BPT_IN_FOR_ONE_TOKEN_OUT) but lacks the required bptAmountIn and tokenIndex fields, causing abi.decode to revert.
**Steps:**
1. Call AuraSpell withdrawal path that invokes wAuraPools.getVault(lpToken).exitPool(poolId, address(this), address(this), ExitPoolRequest(tokens, minAmountsOut, "", false))
2. Balancer decodes empty UserData as ExitKind 0
3. exactBptInForTokenOut abi.decode fails due to missing bptAmountIn/tokenIndex
4. Exit reverts, user funds remain locked
**How found:** Code review of AuraSpell exitPool call noticed UserData hardcoded to empty string; traced Balancer's UserData decoding to confirm ExitKind 0 requires additional encoded fields.
**Insight:** When integrating Balancer/Aura exitPool, always encode UserData matching the intended ExitKind; empty bytes silently decode to ExitKind 0 and revert on missing fields, permanently locking user funds.