# ETH deposited by the user may be stolen.

Tokemak LMPVaultRouterBase wraps ETH to WETH but then pulls WETH again from msg.sender, leaving contract WETH sweepable by anyone via sweepToken.

- Payout: Contest reward
- Severity: high
- Program: Tokemak
- Credited: 0x007
- Disclosed: 2023-06-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-tokemak-judging/issues/1
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-tokemak%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LMPVaultRouterBase deposit/mint router
**Root cause:** _processEthIn wraps msg.value into WETH owned by the router, but pullToken then transfers `amount` WETH from msg.sender instead of using the wrapped balance, so the contract retains excess WETH.
**Steps:**
1. User calls `deposit(vault, to, 10e18, minSharesOut)` with `msg.value=10 ETH` and 10 WETH approved.
2. `_processEthIn` wraps 10 ETH into 10 WETH held by the router.
3. `pullToken(vaultAsset, 10e18, address(this))` pulls another 10 WETH from msg.sender.
4. Router now holds 10 WETH; only 10 WETH is deposited into the vault.
5. Attacker calls `sweepToken(weth, 0, attacker)` to drain the router's WETH balance.
**How found:** Code reading of deposit flow: noticed _processEthIn wraps ETH but pullToken still pulls from msg.sender, creating a mismatch between msg.value and amount, and sweepToken lets anyone drain the router balance.
**Exploitation:** Any user depositing with ETH overpays (ETH wrapped plus WETH pulled), leaving WETH stranded in the router; any attacker calls sweepToken to transfer the full WETH balance to themselves.
**Insight:** When a router both wraps native ETH and pulls ERC20 from the caller, check whether the wrapped balance is actually consumed; any leftover balance plus a public sweep function is a direct theft primitive.