# `Vault::_calcDeposit()` will overflow for low priced tokens Medium · Sherlock · CLMM · 24th February 2025 Finding M-1 of the Yieldoor competition. - Protocol: https://audits.sherlock.xyz/contests/791 - Report: /reports/yieldoor - Codebase: https://github.com/0xsimao/2025-02-yieldoor/tree/b5a0f779dce4236b02665606adb610099451a51a - Source: https://github.com/sherlock-audit/2025-02-yieldoor-judging/issues/85 --- ### Summary `Vault::_calcDeposit()` calculates the `shares` as `depositAmount * bal * totalSupply` in the numerator. If each of these quantities has 18 decimals, this is `1e54` of precision, having only around `1e23` left. Now, if `bal` and `totalSupply` are for example 1e9 each, this leaves `1e5` left. Thus, any deposit exceeding `100_000` will revert. If the token is valued for example 0.01 USD, this is very likely to happen. As deposits failling will make users miss out on yield and favorable entry prices in the pool, it is time sensitive. ### Root Cause In `Vault:149`, there is an [overflow risk](https://github.com/sherlock-audit/2025-02-yieldoor/blob/main/yieldoor/src/Vault.sol#L149). ### Internal Pre-conditions 1. Token is low valued such as 0.1 or 0.01 USD. ### External Pre-conditions None. ### Attack Path 1. User deposits in the vault but reverts, missing out on yield and a certain entry price in the pool. ### Impact User loses yield and may get worse slippage / price afterwards. Additionally, until someone withdraws it may be hard to deposit. They may split their deposits in smaller ones but this has other implications. Given enough balance and supply of a low valued token it may not be possible to deposit at all. ### PoC See above. ### Mitigation Implement some precision downscaling in between calculations. --- Related findings: - [ATokens can be swept of the `PreDepositVault`](https://0xsimao.com/findings/gaib-tokens-swept-pre-deposit): GAIB Pre-Vaults - [Inconsistent Use of `lastCumulativeRate` in `depositTokens()` and `withdraw()` Functions in `Borrowings` Contract](https://0xsimao.com/findings/autonomint-cumulative-deposit-withdraw-borrowings): Autonomint - [`ManagedLeveragedVault::deposit()` slippage control on `collVaultShares` is not intuitive](https://0xsimao.com/findings/beraborrow-i-deposit-slippage-control-shares): Beraborrow Managed Dens - [`ManagedLeveragedVault.sol::deposit()` is missing slippage control](https://0xsimao.com/findings/beraborrow-i-sol-deposit-slippage-control): Beraborrow Managed Dens