# Destination Vault rewards are not added to idleIncrease when info.totalAssetsPulled > info.totalAssetsToPull Crit/High · Sherlock · Liquidity provisioning · 17th July 2023 Finding H-2 of the Tokemak competition. - Protocol: https://audits.sherlock.xyz/contests/101 - Codebase: https://github.com/0xsimao/2023-06-tokemak/tree/5d8e902ce33981a6506b1b5fb979a084602c6c9a - Source: https://github.com/sherlock-audit/2023-06-tokemak-judging/issues/5 --- This result in rewards not being recorded by `LMPVault` and ultimately frozen in the contract. ## Vulnerability Detail In the `_withdraw` function, Destination Vault rewards will be first recorded in `info.IdleIncrease` by `info.idleIncrease += _baseAsset.balanceOf(address(this)) - assetPreBal - assetPulled;`. But when `info.totalAssetsPulled > info.totalAssetsToPull`, `info.idleIncrease` is directly assigned as `info.totalAssetsPulled - info.totalAssetsToPull`, and `info.totalAssetsPulled` is `assetPulled` without considering Destination Vault rewards. https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/vault/LMPVault.sol#L482-L497 ```solidity uint256 assetPreBal = _baseAsset.balanceOf(address(this)); uint256 assetPulled = destVault.withdrawBaseAsset(sharesToBurn, address(this)); // Destination Vault rewards will be transferred to us as part of burning out shares // Back into what that amount is and make sure it gets into idle info.idleIncrease += _baseAsset.balanceOf(address(this)) - assetPreBal - assetPulled; info.totalAssetsPulled += assetPulled; info.debtDecrease += totalDebtBurn; // It's possible we'll get back more assets than we anticipate from a swap // so if we do, throw it in idle and stop processing. You don't get more than we've calculated if (info.totalAssetsPulled > info.totalAssetsToPull) { info.idleIncrease = info.totalAssetsPulled - info.totalAssetsToPull; info.totalAssetsPulled = info.totalAssetsToPull; break; } ``` For example, ```solidity // preBal == 100 pulled == 10 reward == 5 toPull == 6 // idleIncrease = 115 - 100 - 10 == 5 // totalPulled(0) += assetPulled == 10 > toPull // idleIncrease = totalPulled - toPull == 4 < reward ``` The final `info.idleIncrease` does not record the reward, and these assets are not ultimately recorded by the Vault. ## Impact The final `info.idleIncrease` does not record the reward, and these assets are not ultimately recorded by the Vault. Meanwhile, due to the `recover` function's inability to extract the `baseAsset`, this will result in no operations being able to handle these Destination Vault rewards, ultimately causing these assets to be frozen within the contract. ## Code Snippet https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/vault/LMPVault.sol#L482-L497 ## Tool used Manual Review ## Recommendation `info.idleIncrease = info.totalAssetsPulled - info.totalAssetsToPull;` -> `info.idleIncrease += info.totalAssetsPulled - info.totalAssetsToPull;` --- Related findings: - [Newly added rewards will not be immediately collected](https://0xsimao.com/findings/yieldoor-i-newly-rewards-immediately-collected): Yieldoor Gauges - [BasicVault::_deposit() should always resolve with idle balance as the redeem queue may be disabled with requests pending](https://0xsimao.com/findings/mitosis-deposit-resolve-redeem-queue): Mitosis - [BasicVault::_resolveWithIdleBalance() can return before calculating _idleBalance() to save gas](https://0xsimao.com/findings/mitosis-resolve-idle-calculating-gas): Mitosis - [`VaultV2::withdraw/redeem()` are vulnerable to slippage, so another function could be added to protect users](https://0xsimao.com/findings/morpho-vault-v2-withdraw-redeem-slippage-protect): Morpho Vault V2