# Controller.setCap sets wrong vault balance

Controller.setCap subtracted the entire strategy balance instead of the withdrawn diff, corrupting vault balance accounting and enabling share-price manipulation for profit.

- Payout: Audit contest
- Severity: high
- Program: yAxis
- Found by: cmichel
- Disclosed: 2021-11-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-yaxis-findings/issues/128
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AH-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Controller.setCap / vault balance accounting (Solidity)
**Root cause:** setCap withdraws only the excess `_diff` from a strategy but decrements `_vaultDetails[_vault].balance` by the full strategy `_balance`, understating the tracked vault balance.
**Steps:**
1. Call `Controller.setCap` on a vault whose strategy balance exceeds the new cap.
2. Observe `_vaultDetails[_vault].balance = _vaultDetails[_vault].balance.sub(_balance)` subtracts full strategy balance rather than `_diff`.
3. `Controller.balanceOf()` now returns an understated value, propagating to `Vault.balance()`.
4. Attacker calls `deposit` while balance is understated to mint excess shares.
5. Wait until balance is corrected, then redeem shares for more than deposited.
**How found:** Code review of setCap's accounting: noticed the subtraction used `_balance` instead of the withdrawn `_diff`, then traced the corrupted variable through balanceOf into share minting/redemption.
**Exploitation:** Deposit into the vault while the tracked balance is artificially low to receive more shares than deserved, then redeem after the balance is restored, extracting value from the vault.
**Insight:** When a function withdraws only a delta, verify the accounting update subtracts that same delta, not the full position; trace any balance variable into share-price math to gauge exploitability.