# Mint without minimum input or decimal check

Mint/swap paths that skip minimum input or decimal normalization, minting unbacked value

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2024-02-21. Updated 2026-10-30._

## How it works
A mint or swap path assumes its inputs are already normalized and non-trivial. When a caller supplies a tiny or zero amount on one leg, or when a wrapped/offset amount is forwarded instead of the actual amount, the output formula still computes a full-sized result. The contract credits value it never received: shares, tokens, or wrapped balances that exceed backing. The broken assumption is "amountIn means the same thing everywhere and is always meaningful."

## Where it shows up
- Mint functions with no minimum or nonzero check on the input leg [E3](https://bugbountylibrary.com/r/dhl%3A20220309-fantasm.md)
- Price/ratio formulas with decimal scaling errors that inflate output [E3](https://bugbountylibrary.com/r/dhl%3A20220309-fantasm.md)
- Router functions that wrap tokens to normalize decimals but pass the pre-wrap amount downstream [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-jala-swap%3AM-2.md)
- Public functions accepting ETH and minting tokens without price validation (unconfirmed in evidence) [E2](https://bugbountylibrary.com/r/dhl%3A20240223-zoomer.md)

## How to review
For every mint/swap, trace the amount from entry to the output formula. The invariant: the amount used to compute output must equal the amount actually received, in the same decimal scale, and must be bounded below by a caller-supplied minimum. Check that the input leg enforces a nonzero/minimum input, and that the ratio formula's precision scaling matches token decimals. For wrapping routers, verify each downstream call receives the wrapped amount (original amount multiplied by the token's decimal offset), not the original amount; confirm the offset multiplication happens before the call, not after.

## Variants seen
- Decimal-offset mismatch in a wrapping router: pre-wrap amountIn forwarded downstream, leaving wrapped tokens stuck and stealable [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-jala-swap%3AM-2.md)
- Public mint/swap with flawed validation mints disproportionate tokens for tiny ETH [E2](https://bugbountylibrary.com/r/dhl%3A20240223-zoomer.md)
- Missing minimum input plus decimal error in calcMint mints unbacked tokens [E3](https://bugbountylibrary.com/r/dhl%3A20220309-fantasm.md)

## Impact and severity
Led to unbacked value and direct fund loss: ~$2.62M drained [E3](https://bugbountylibrary.com/r/dhl%3A20220309-fantasm.md), ~14 ETH from pools [E2](https://bugbountylibrary.com/r/dhl%3A20240223-zoomer.md), and stuck/stealable tokens in a shared router balance [E1](https://bugbountylibrary.com/r/sherlock%3A2024-02-jala-swap%3AM-2.md). Severity is high because the flaw is reachable by any caller and converts a small input into large value. It worsens when the contract holds pooled liquidity or when leftovers accumulate in a shared router balance.

## Why fixes fail
No evidence of incomplete or regressed fixes in the provided reports.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-02-jala-swap%3AM-2.md
- E2: https://bugbountylibrary.com/r/dhl%3A20240223-zoomer.md
- E3: https://bugbountylibrary.com/r/dhl%3A20220309-fantasm.md