# Stargate Pools conversion rate leads to token accumulation inside the Balancer contract

Balancer rebalance passes non-convert-rate-multiple amounts to Stargate, leaving dust tokens and dangling allowances in the contract.

- Payout: Contest reward
- Severity: medium
- Program: Tapioca
- Credited: GiuseppeDeLaZara
- Disclosed: 2024-02-14
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-tapioca-judging/issues/71
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-15
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:precision-loss

**Target:** Balancer rebalance function interacting with StargateRouter
**Root cause:** Rebalance amount is not rounded to Stargate pool convertRate (10^(localDecimals-sharedDecimals)), so Stargate consumes only a multiple of convertRate while the full amount was extracted and approved.
**Steps:**
1. Note DAI Stargate pool has sharedDecimals=6, localDecimals=18, convertRate=10^12.
2. Call rebalance with _amount not a multiple of 10^12.
3. Balancer extracts full _amount from mTOFT and approves full _amount to StargateRouter.
4. Stargate transfer consumes only floor(_amount/convertRate)*convertRate, leaving remainder in Balancer and residual allowance.
5. Repeat to accumulate tokens and dangling allowances.
**How found:** Reviewer reasoned about Stargate pool convert rate semantics (sharedDecimals vs localDecimals) and traced how rebalance extracts and approves amounts without rounding to convertRate.
**Exploitation:** Repeated rebalance calls with non-multiple amounts accumulate ERC20 dust inside Balancer and leave residual allowances to StargateRouter; loss only materializes if StargateRouter is compromised upstream.
**Insight:** When integrating Stargate pools, always round transfer amounts down to the pool's convertRate; otherwise the router silently consumes less than approved, leaving dust and live allowances in the caller contract.