# If totalShares for a token falls to zero while there is pendingCredit the contract will become stuck

AlchemistV2 divides by totalShares in credit distribution; if all shares are withdrawn while pendingCredit remains, all core functions revert permanently.

- Payout: Audit contest
- Severity: medium
- Program: Alchemix
- Found by: AuditsAreUS
- Disclosed: 2022-07-18
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-05-alchemix#m-16
- Library page: http://bugbountylibrary.com/r/c4%3A2022-05-alchemix%3AM-16
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** AlchemistV2 yield-token accounting contract
**Root cause:** Credit distribution and share conversion functions divide by yieldTokenParams.totalShares without guarding against zero, so the last full withdrawal while pendingCredit is nonzero leaves the contract in a state where every such call reverts.
**Steps:**
1. User calls `deposit()`; time passes accruing yield.
2. Keeper calls `harvest()`, which invokes `_distributeCredit()` and increases `pendingCredit`.
3. User calls `withdraw()` for all funds, driving `yieldTokenParams.totalShares` to zero while `unlockedCredit` remains nonzero.
4. Subsequent calls to `_distributeUnlockedCredit()` compute `unlockedCredit * FIXED_POINT_SCALAR / yieldTokenParams.totalShares` and revert on division by zero, bricking deposit/withdraw/mint/burn/repay/liquidate/donate/harvest.
**How found:** Code review of share/credit accounting: noticed totalShares is used as a divisor in multiple credit-distribution paths with no zero-check, then constructed the deposit→harvest→full-withdraw sequence to reach totalShares==0 with pendingCredit outstanding.
**Insight:** In share-based accounting, any divisor of totalShares needs an explicit zero-state policy (dead shares, minimum lock, or last-withdrawer sweep of pending credit); trace every function that divides by total supply and ask what state remains after the last user exits.