# BadgerYieldSource balanceOfToken share calculation seems wrong

BadgerYieldSource.balanceOfToken used badger.balanceOf(badgerSett) instead of badgerSett.balance(), under-reporting user redeemable balances because most capital sits in strategies.

- Payout: Audit contest
- Severity: high
- Program: PoolTogether
- Found by: cmichel
- Disclosed: 2021-09-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-06-pooltogether-findings/issues/84
- Library page: https://bugbountylibrary.com/r/c4%3A2021-06-pooltogether%3AH-03
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** BadgerYieldSource yield source contract (Solidity)
**Root cause:** balanceOfToken computes pro-rata share against badger.balanceOf(address(badgerSett)), which only reflects the small reserve held in the Sett, not funds deployed to strategies. Should use badgerSett.balance() which aggregates Sett, Controller and Strategy balances.
**Steps:**
1. Read balanceOfToken: `balances[addr].mul(badger.balanceOf(address(badgerSett))).div(badgerSett.totalSupply())`
2. Observe badger.balanceOf(badgerSett) only counts the Sett's reserve, since most capital is in strategies
3. Compare with badgerSett.balance() which sums Sett + Controller + Strategy balances
4. Any integrator calling balanceOf receives a value far below actual redeemable balance
**How found:** Code review of the share math; noticed the numerator used the underlying token balance of the Sett rather than the Sett's own accounting, and cross-checked Badger docs stating most funds live in strategies.
**Insight:** When integrating a yield-bearing wrapper (Sett/vault), never use underlyingToken.balanceOf(wrapper) as the total assets figure — most capital is delegated to strategies; use the wrapper's own balance()/totalAssets() accounting.