# ATokens can be swept of the `PreDepositVault` Low/Info · Sherlock · AI compute financing · 28th March, 2025 Finding L-2 of the GAIB Pre-Vaults security review. - Protocol: https://gaib.ai/ - Report: /reports/gaib - Source: https://4221781861-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLXNTW9blcTeiKZrMFhab%2Fuploads%2FQMsETA4dRNo2auiUSeOX%2FAIDa%20Vault%20Audit_20250411.pdf?alt=media&token=5e2f84ea-9698-4fa7-81ef-503771d234aa --- ## Summary `PreDepositVault::sweep()` allows sweeping `aTokens`, decreasing users' deposits. Same for USDS. ## Vulnerability Detail `PreDepositVault::totalAssets()` is composed of `asset()` and `aToken`. Decreasing one of them leads to user losses. ## Impact User losses ## Code Snippet https://github.com/sherlock-audit/2025-03-gaib/blob/main/pre-vaults/contracts/pre-vaults/gpdWBTC.sol#L86 ## Tool Used Manual Review ## Recommendation It's an admin function so could be left as is, but keep this in mind. --- Related findings: - [`Vault::_calcDeposit()` will overflow for low priced tokens](https://0xsimao.com/findings/yieldoor-calc-deposit-overflow-priced): Yieldoor - [Inconsistent Use of `lastCumulativeRate` in `depositTokens()` and `withdraw()` Functions in `Borrowings` Contract](https://0xsimao.com/findings/autonomint-cumulative-deposit-withdraw-borrowings): Autonomint - [`ManagedLeveragedVault::deposit()` slippage control on `collVaultShares` is not intuitive](https://0xsimao.com/findings/beraborrow-i-deposit-slippage-control-shares): Beraborrow Managed Dens - [`ManagedLeveragedVault.sol::deposit()` is missing slippage control](https://0xsimao.com/findings/beraborrow-i-sol-deposit-slippage-control): Beraborrow Managed Dens