# Yield Protocol Logic Error Bugfix Review

Yield Protocol strategy burn() priced LP tokens off manipulable pool.balanceOf, letting an attacker inflate and drain base tokens from pools.

- Payout: $95,000
- Severity: critical
- Program: Yield Protocol
- Credited: Paludo0x
- Disclosed: 2023-07-25
- Write-up quality: 7/10
- Original: https://immunefi.com/blog/bug-fix-reviews/yield-protocol-logic-error/
- Library page: https://bugbountylibrary.com/r/blog%3Aimmunefi-com-blog-bug-fix-reviews-yield-protocol-logic-error
- Tags: domain:web3 impact:funds-loss kind:bounty platform:blog platform:immunefi sev:critical tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** YieldSpace strategy contract burn(address) on Arbitrum and Ethereum
**Root cause:** burn() computed poolTokensObtained from pool.balanceOf(address(this)) * burnt / totalSupply_, so directly transferring pool tokens to the strategy contract inflated the payout.
**Steps:**
1. Transfer a specific amount of pool tokens directly to the strategy contract to inflate pool.balanceOf(address(this))
2. Call burn(to) to receive inflated poolTokensObtained based on the inflated balance
3. Call mint(...) to obtain strategy share tokens
4. Call burn(...) again to recover the LP tokens used to inflate the calculation
**How found:** Whitehat noticed burn() derived payout from the live pool.balanceOf(address(this)) rather than a cached accounting value, making the payout manipulable by direct token transfer.
**Exploitation:** Attacker donates pool tokens to the strategy contract to inflate the balance used in the burn payout formula, then burns strategy shares to withdraw more LP tokens than entitled, then mints and burns again to recover the donated tokens, netting the excess drained from the pool.
**Insight:** In share-based vaults, check whether redemption math reads live token balances (balanceOf) instead of internal cached accounting; a direct transfer can inflate the numerator and be recovered via a subsequent mint/burn round-trip.