# Liquidity add skips ratio check

Deposit or mint paths that forward raw balances or assume parity without checking reserve ratios

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2025-01-08. Updated 2026-10-30._

## How it works
A deposit or mint path moves tokens into a pool or vault without verifying that the amounts match the existing reserve ratio (or, in multi-asset vaults, that the assets are actually at parity). The pool then prices the deposit using its own curve, which penalizes imbalance. The depositor receives fewer shares/LP tokens than the value deposited, and the shortfall is left in the pool for others to capture. The broken assumption is that "deposit amount in = fair value in"; the code never enforces proportionality.

## Where it shows up
- Add-liquidity or mint functions that forward `balanceOf(this)` or full user balances instead of computed proportional amounts [E2](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-04.md).
- Swap sizing that uses only the input amount and ignores the contract's existing balance of the output token [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AH-4.md).
- Multi-asset vaults that mint/redeem shares at 1:1 across assets assumed to be equal price [E3](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-05.md).
- Deposit and withdraw callable in the same transaction with only a flat fee as protection [E3](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-05.md).
- Slippage bounds on `addLiquidity` that revert when the ratio is skewed, rather than correcting it [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AH-4.md).

## How to review
Check the exact invariant: for any deposit, the amounts supplied must be proportional to current reserves (or the mint must be priced off actual pool math, not parity). Trace every path that reads `balanceOf` and forwards it to an AMM. Confirm swap sizing subtracts already-held counterparty balance. For vaults, confirm deposit and withdraw cannot be composed atomically to arbitrage an off-peg asset, or that share pricing reflects real prices.

## Variants seen
- Full-balance forward to a stableswap pool with no ratio check, minting too few LP tokens [E2](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-04.md).
- Swap amount computed from input only, ignoring held pTKN, so imbalance compounds until addLiquidity reverts [E1](https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AH-4.md).
- Parity assumption across vault assets plus atomic deposit/withdraw, turning the withdrawal fee into a swap fee [E3](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-05.md).

## Impact and severity
Value loss to the depositor and value transfer to arbitrageurs [E2](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-04.md)[E3](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-05.md); in E1 the imbalance compounds across epochs until the autocompounding path reverts, DoSing it and stranding funds. Severity rises when the skewed state persists or compounds, and when atomic composition lets an attacker capture the shortfall in one transaction.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-01-peapods-finance%3AH-4.md
- E2: https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-04.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-05.md