# The `_estimateWithdrawalLp` function might return a very large value, result in users losing significant incentives or being unable to withdraw from the Dispatcher contract

Dispatcher's _estimateWithdrawalLp averages fee/reserve ratios; UniswapV3 concentrated-liquidity reserve swings inflate LP estimate above user shares, reverting withdrawals or over-withdrawing LP.

- Payout: Contest reward
- Severity: high
- Program: Real Wagmi
- Credited: crimson-rat-reach
- Disclosed: 2023-06-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-real-wagmi-judging/issues/142
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-real-wagmi%3AH-5
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** Dispatcher.sol _estimateWithdrawalLp / withdraw / deposit
**Root cause:** _estimateWithdrawalLp computes shareAmount as the average of amount0/totalSupply/reserve0 and amount1/totalSupply/reserve1; reserve0/reserve1 from Multipool positions in concentrated UniswapV3 ranges swing wildly, so a small fee can map to a huge LP share amount.
**Steps:**
1. Alice deposits 1e16 of 1e18 totalSupply (1%) into Dispatcher.
2. Alice accrues fees 200 USDC + 100 USDT; reserves 100k/100k → lpAmount ≈ 1.5e15.
3. Pool price moves so Multipool reserves become 10k USDC / 190k USDT.
4. _estimateWithdrawalLp now returns ≈1.026e16 > Alice's 1e16 shares.
5. user.shares -= lpAmount underflows → deposit/withdraw reverts, or over-withdraws Multipool LP.
**How found:** Code review of the fee-to-LP conversion: noticed the average-of-ratios formula assumes stable reserves, then reasoned that concentrated-liquidity positions can flip token composition (e.g. 1e21/0 to 0/1e21) on a single swap, making the estimate unbounded relative to user shares.
**Exploitation:** No attacker action required; any user calling deposit/withdraw after a large UniswapV3 price move within a narrow tick range triggers underflow revert (funds stuck) or disproportionate LP withdrawal, diluting other depositors.
**Insight:** When a contract converts value using pool reserves, check whether those reserves come from concentrated-liquidity positions whose token composition can swing orders of magnitude within a tick range; average-of-ratios formulas are especially fragile because one near-zero reserve term dominates.