# AuraSpell openPositionFarm does not join pool

AuraSpell.openPositionFarm computes poolAmountOut as min of two token amounts, but only one token is borrowed, so it's always 0 and joinPool never executes.

- Payout: Contest reward
- Severity: medium
- Program: Blueberry
- Credited: Ch_301
- Disclosed: 2023-04-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-04-blueberry-judging/issues/46
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-blueberry%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** AuraSpell.openPositionFarm (Balancer pool join logic)
**Root cause:** poolAmountOut is computed as the minimum of poolAmountFromA and poolAmountFromB, but only one borrow token is held so one maxAmountsIn is 0, making the min always 0 and the `if (poolAmountOut > 0)` guard always false.
**Steps:**
1. Call `openPositionFarm` with a strategyId and collToken.
2. Function lends collateral via `_doLend` and borrows a single borrowToken via `_doBorrow`.
3. maxAmountsIn[0] and maxAmountsIn[1] are set from balances; only one is nonzero.
4. poolAmountFromA or poolAmountFromB computes to 0, so `poolAmountOut = min(...) = 0`.
5. `if (poolAmountOut > 0)` is false; `vault.joinPool` is skipped and function returns without reverting.
**How found:** Code reading of the joinPool amount computation: noticed only one token is borrowed yet the min of two per-token pool amounts is used as the join amount, making the guard unreachable.
**Insight:** When a contract computes a join/deposit amount as the min across multiple tokens, verify all those tokens are actually held; single-sided borrow flows make min-based guards silently no-op.