# set cap breaks vault's Balance

Controller.setCap subtracts the strategy's remaining balance instead of the balance delta, understating vault balance and locking funds in the strategy.

- Payout: Audit contest
- Severity: high
- Program: yAxis
- Found by: jonah1005
- Disclosed: 2021-11-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-yaxis-findings/issues/1
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AH-02
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Controller.sol setCap vault accounting
**Root cause:** setCap subtracts the strategy's full remaining balance from _vaultDetails[_vault].balance instead of the difference between previous and new strategy balance, making the vault balance far smaller than actual strategy value.
**Steps:**
1. Read Controller.sol L262-L278: `_vaultDetails[_vault].balance = _vaultDetails[_vault].balance.sub(_balance);`
2. Call `strategy.balanceOf()` to get strategy_balance
3. Call `controller.setCap(vault, strategy, strategy_balance - 1, dai)`
4. Call `vault.withdrawAll(dai)` — reverts at Controller.sol#475 assertion because vault balance is understated
**How found:** Code review of setCap's balance accounting; noticed the subtraction used the strategy's remaining balance rather than the delta, then verified via Hardhat PoC that withdrawAll reverts.
**Exploitation:** Operator-only function; calling setCap with a cap slightly below strategy balance corrupts vault balance accounting, causing withdrawAll to revert and funds to be locked in the strategy.
**Insight:** When auditing cap/limit setters, check that accounting deltas use previous-vs-new differences, not absolute remaining balances; a one-wei cap change can desync vault accounting and brick withdrawals.