# ArrakisV2Router#addLiquidityPermit2 will strand ETH

ArrakisV2Router.addLiquidityPermit2 never sets isToken0Weth, so ETH refunds are miscalculated, stranding ETH in the router that anyone can later steal.

- Payout: Contest reward
- Severity: high
- Program: Arrakis
- Credited: 0x007
- Disclosed: 2023-06-05
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-arrakis-judging/issues/183
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-arrakis%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ArrakisV2Router.addLiquidityPermit2 (Solidity router contract)
**Root cause:** `bool isToken0Weth;` is declared but never assigned, so it is always false; the refund branch compares msg.value against amount1 even when WETH is token0, refunding the wrong amount and leaving excess ETH in the contract.
**Steps:**
1. Call `addLiquidityPermit2` with msg.value > 0 where token0 is WETH.
2. Observe `isToken0Weth` defaults to false, so refund uses `msg.value - amount1` instead of `msg.value - amount0`.
3. Excess ETH remains in the router contract.
4. Attacker later calls the same function to sweep the stranded ETH; can also manipulate underlying pools to inflate the stranded amount.
**How found:** Code reading of the refund logic in addLiquidityPermit2 revealed `isToken0Weth` was declared but never assigned, making the branch condition always false.
**Exploitation:** Any user calling addLiquidityPermit2 with WETH as token0 leaves excess ETH in the router; a subsequent caller can craft a call to have the excess refunded to themselves, and can manipulate pool state to increase the stranded balance before sweeping.
**Escalation:** Attacker manipulates underlying pools to increase the amount of ETH stranded in the router, then drains it via the same refund path.
**Insight:** In Solidity, uninitialized bool locals default to false silently; audit refund/change-return paths for variables that are declared but never assigned, especially where token ordering (token0/token1) determines which branch runs.