# No check for `initialEth` in `GoatV1Pair.takeOverPool()`.

GoatV1Pair.takeOverPool() lacks a check on initParams.initialEth, allowing a takeover with initialEth=0 by bypassing the token amount check.

- Payout: Contest reward
- Severity: medium
- Program: Goat Trading
- Credited: whitehair0330
- Disclosed: 2024-03-10
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-03-goat-trading-judging/issues/43
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-goat-trading%3AM-2
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium technique:source-review vuln:business-logic

**Target:** GoatV1Pair smart contract
**Root cause:** takeOverPool() validates the new token amount but not initialEth; setting initialEth=0 inflates the computed token amounts, bypassing the minimum token requirement.
**Steps:**
1. Call `takeOverPool(initParams)` with `initParams.initialEth = 0`.
2. The computed `tokenAmountForAmmNew + tokenAmountForPresaleNew` becomes larger, passing the check at L481.
3. Proceed with takeover by providing required token and WETH amounts.
**How found:** Manual review of takeOverPool() revealed that only token amounts are checked, not initialEth; setting initialEth to 0 inflates the computed token amounts and bypasses the check.
**Exploitation:** An attacker calls takeOverPool with initialEth=0, bypassing the token amount check and taking over the pool without meeting the intended token requirement.
**Insight:** When auditing takeover or re-initialization functions, verify that all parameters used in subsequent calculations are validated, especially those that can be zeroed to manipulate derived values.