# Incorrect ProtocolOwnedLiquidityOhm calculation due to inclusion of other user's reserves

BunniSupply summed all BunniToken reserves as protocol-owned liquidity, letting any user's deposits inflate OHM backing and misprice treasury swaps.

- Payout: Contest reward
- Severity: high
- Program: Olympus
- Credited: hash
- Disclosed: 2023-11-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-11-olympus-judging/issues/172
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-11-olympus%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** BunniSupply submodule / BunniHub deposit
**Root cause:** getProtocolOwnedLiquidityOhm sums reserves of all BunniTokens, but BunniHub.deposit is permissionless, so reserves include liquidity owned by arbitrary users rather than only the protocol.
**Steps:**
1. Read `BunniSupply.getProtocolOwnedLiquidityOhm()` looping over `bunniTokens` and calling `_getOhmReserves(key, lens)`
2. Observe `BunniHub.deposit(DepositParams)` has no access control and is callable by any user
3. Deposit liquidity into a tracked BunniToken to increase its reserves
4. Call `getProtocolOwnedLiquidityOhm()` and see the total inflated by the attacker's deposit
**How found:** Code reading: noticed the POL getter aggregates raw token reserves, then checked BunniHub.deposit and found it permissionless, meaning reserves are not exclusively protocol-owned.
**Exploitation:** Attacker deposits liquidity into a BunniToken tracked by BunniSupply, inflating reported protocol-owned OHM reserves; the wider system uses this supply figure to price OHM-for-treasury-asset exchanges, so the attacker can trade at a wrong price.
**Insight:** When a contract reports 'protocol-owned' value by reading pool/token reserves, verify whether the underlying deposit path is permissionless; if so, reserves are attacker-inflatable and any downstream pricing is manipulable.