# SynthVault deposit lockup bypass

SynthVault.harvestSingle mints synths based on the pool's total BASE balance, letting an attacker pre-send BASE and get credited weight without a lockup.

- Payout: Audit contest
- Severity: medium
- Program: Spartan Protocol
- Found by: cmichel
- Disclosed: 2021-09-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-07-spartan-findings/issues/167
- Library page: https://bugbountylibrary.com/r/c4%3A2021-07-spartan%3AM-08
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:business-logic

**Target:** SynthVault.harvestSingle / pool mintSynth
**Root cause:** harvestSingle mints synths from the pool's total BASE balance rather than only the reward amount, so any BASE the attacker pre-transfers to the pool is counted and credited to their weight.
**Steps:**
1. Attacker transfers BASE tokens directly to the pool.
2. Attacker calls `SynthVault.harvestSingle`, which invokes `iPOOL(_poolOUT).mintSynth(synth, address(this));`.
3. mintSynth mints synths based on the pool's total BASE balance including the attacker's transfer.
4. Attacker is credited the entire minted amount to their `weight`, achieving a mint+deposit with no lockup.
**How found:** Code review of harvestSingle's mintSynth call and noticing it uses the pool's total BASE balance, which an attacker can inflate by direct transfer.
**Exploitation:** Pre-send BASE to the pool, then call harvestSingle to mint synths against that balance and have them credited to attacker weight, skipping the lockup period.
**Insight:** When a harvest/reward function mints or credits based on a pool's total token balance, check whether an attacker can pre-fund that balance to inflate their own credit; syncing the pool before granting funds wastes prior transfers.