Submitted by mookimgo, also found by hansfriese
https://github.com/code-423n4/2023-01-timeswap/blob/main/packages/v2-token/src/TimeswapV2LiquidityToken.sol#L114 
https://github.com/code-423n4/2023-01-timeswap/blob/main/packages/v2-token/src/TimeswapV2Token.sol#L103
Assuming ERC1155Enumerable is acting normally, there is an Accounting Issue about TimeswapV2LiquidityToken and TimeswapV2Tokens tokenId.
Different liquidities can have the same tokenId, leading to serious balance manipulation.
Im submitting this issue as medium because current implementation ERC1155Enumerable is wrong, which exactly mitigates this issue making it not exploitable. But this issue will become dangerous once we fixed ERC1155Enumerable.
In this PoC, the attacker will do these steps:
Explanation:
https://github.com/code-423n4/2023-01-timeswap/blob/main/packages/v2-token/src/TimeswapV2LiquidityToken.sol#L112
As the comment said, if the position does not exist, create it, but the new tokenId is set as totalSupply() + 1.
Function totalSupply is defined in packages/v2-token/src/base/ERC1155Enumerable.sol, which is simply \_allTokens.length: https://github.com/code-423n4/2023-01-timeswap/blob/main/packages/v2-token/src/base/ERC1155Enumerable.sol#L37-L38
\_allTokens.length can be decreased in _removeTokenFromAllTokensEnumeration function, which is called by _removeTokenEnumeration, and by _afterTokenTransfer. In simple words, when all token amounts for a specific tokenId are burned (_idTotalSupply[id] == 0), totalSupply should be decreased.
Current implementation of ERC1155Enumerable has a bug, which will never trigger _removeTokenFromAllTokensEnumeration: Calling \_removeTokenEnumeration needs amount>0, but only _idTotalSupply[id] == 0 can trigger \_removeTokenFromAllTokensEnumeration.
Once the above code gets fixed (swapping the if line and _idTotalSupply[id] -= amount; line, patch given below), this issue becomes exploitable, making the accounting of LP wrong.
Proof of Concept steps:
First, we need to patch two contracts:
Add a new test file in 2023-01-timeswap/packages/v2-token/test/TimeswapV2LiquidityToken_MultiMint.t.sol:
Here is the log for the above test: forge test --match-path test/TimeswapV2LiquidityToken_MultiMint.t.sol -vv
Do not use totalSupply() or other maybe-decreasing variables for new tokenId.
Patch file can be like this:
Picodes (judge) increased severity to High 
vhawk19 (Timeswap) confirmed and resolved:
