Incorrect ProtocolOwnedLiquidityOhm calculation due to inclusion of other user's reserves
ProtocolOwnedLiquidityOhm for Bunni can include the liquidity deposited by other users which is not protocol owned\\nThe protocol owned liquidity in Bunni is calculated as the sum of reserves of all the BunniTokens\\n```\\n    function getProtocolOwnedLiquidityOhm() external view override returns (uint256) {\\n\\n        uint256 len = bunniTokens.length;\\n        uint256 total;\\n        for (uint256 i; i < len; ) {\\n            TokenData storage tokenData = bunniTokens[i];\\n            BunniLens lens = tokenData.lens;\\n            BunniKey memory key = _getBunniKey(tokenData.token);\\n\\n        // rest of code// rest of code// rest of code\\n\\n            total += _getOhmReserves(key, lens);\\n            unchecked {\\n                ++i;\\n            }\\n        }\\n\\n\\n        return total;\\n    }\\n```\\n\\nThe deposit function of Bunni allows any user to add liquidity to a token. Hence the returned reserve will contain amounts other than the reserves that actually belong to the protocol\\n```\\n    // @audit callable by any user\\n    function deposit(\\n        DepositParams calldata params\\n    )\\n        external\\n        payable\\n        virtual\\n        override\\n        checkDeadline(params.deadline)\\n        returns (uint256 shares, uint128 addedLiquidity, uint256 amount0, uint256 amount1)\\n    {\\n    }\\n```\\n
Guard the deposit function in BunniHub or compute the liquidity using shares belonging to the protocol
Incorrect assumption of the protocol owned liquidity and hence the supply. An attacker can inflate the liquidity reserves The wider system relies on the supply calculation to be correct in order to perform actions of economical impact
```\\n    function getProtocolOwnedLiquidityOhm() external view override returns (uint256) {\\n\\n        uint256 len = bunniTokens.length;\\n        uint256 total;\\n        for (uint256 i; i < len; ) {\\n            TokenData storage tokenData = bunniTokens[i];\\n            BunniLens lens = tokenData.lens;\\n            BunniKey memory key = _getBunniKey(tokenData.token);\\n\\n        // rest of code// rest of code// rest of code\\n\\n            total += _getOhmReserves(key, lens);\\n            unchecked {\\n                ++i;\\n            }\\n        }\\n\\n\\n        return total;\\n    }\\n```\\n