# totalShares update should add before reducing to avoid underflows Low/Info · Three Sigma · Modular blockchain infrastructure · 27th January 2024 Finding 3S-TR-L01 of the Trestle wTIA Bridge security review. - Report: /reports/trestle-wtia-bridge - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-01-27-trestle.pdf --- ### Description totalShares [update](https://github.com/TrestleProtocol/Audit-Contracts/blob/main/src/Trestle.sol#L685) subtracts before summing, which could lead to underflow in edge cases (when something unexpected happens). ### Status Acknowledged. Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [`LenderCommitmentGroup_Smart_test::addPrincipalToCommitmentGroup/burnSharesToWithdrawEarnings()` are vulnerable to slippage attacks](https://0xsimao.com/findings/teller-finance-burn-shares-withdraw-slippage): Teller Finance - [Type 1 borrower liquidation will incorrectly add cds profit directly to `totalCdsDepositedAmount`](https://0xsimao.com/findings/autonomint-type-liquidation-directly-deposited): Autonomint - [Missing Update to `omnichain.totalAvailableLiquidationAmount` in `withdrawUser`](https://0xsimao.com/findings/autonomint-omnichain-available-liquidation-withdraw): Autonomint - [In LoopStrategy::withdraw(), _updateLastTotalAssets() is called after _withdraw()](https://0xsimao.com/findings/more-markets-loop-withdraw-last-called): MORE Optimizer