# Vault multihop swaps for any token pair will fail in one direction

SwapRouter.add_path stored one multihop path for both swap directions, so reverse swaps fed Uniswap a path starting with the output token and reverted.

- Payout: Contest reward
- Severity: medium
- Program: Unstoppable
- Credited: 0x00ffDa
- Disclosed: 2023-06-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-unstoppable-judging/issues/108
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AM-7
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** SwapRouter.vy add_path / Vault multihop swap path
**Root cause:** add_path stores the identical _path bytes under both paths[token1][token2] and paths[token2][token1]; the reverse lookup returns a path whose first address is the output token, which Uniswap V3 SwapRouter decodes as tokenIn.
**Steps:**
1. Admin calls `add_path(token1, token2, path)` where path begins with token1.
2. Both `self.paths[token1][token2]` and `self.paths[token2][token1]` are set to the same bytes.
3. User swaps token2->token1; Vault fetches `self.paths[token2][token1]` = path starting with token1.
4. Uniswap SwapRouter `decodeFirstPool()` reads tokenIn=token1 (the intended output), attempts to pull token1 from the Unstoppable SwapRouter, which has no allowance, and reverts.
**How found:** Code review of add_path's symmetric storage versus the Vault's directional lookup and Uniswap's assumption that the first path address is tokenIn.
**Escalation:** If a position is opened via the working direction, closing it requires the reverse multihop swap which reverts, locking margin funds until admin re-adds a corrected path; liquidators also cannot force-exit.
**Insight:** When a contract stores a directional encoding (Uniswap path bytes) under symmetric bidirectional keys, check whether the consumer decodes direction from the bytes themselves rather than the lookup key.