# Vault treats all tokens exactly the same that creates (huge) arbitrage opportunities.

yAxis v3 vault mints shares 1:1 across all accepted tokens, letting attackers deposit a cheaper LP token like 3CRV and withdraw an equal amount of a stablecoin for risk-free arbitrage.

- Payout: Audit contest
- Severity: high
- Program: yAxis
- Disclosed: 2021-11-10
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-09-yaxis-findings/issues/2
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AH-05
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** yAxis v3 Vault deposit/withdraw share accounting
**Root cause:** Vault mints shares equal to deposited amount and burns shares pro-rata to balance without pricing each token, so all accepted tokens are treated as equal value regardless of actual market price.
**Steps:**
1. Acquire USDT (or flash-loan it) and `approve` the vault
2. Call `vault.deposit(usdt.address, deposit_amount)` to mint shares 1:1
3. Call `vault.withdrawAll(t3crv.address)` to redeem shares in 3CRV
4. Remove 3CRV liquidity and keep the price differential (~0.8%) as profit
**How found:** Code review of Vault.sol deposit/withdraw: noticed `_shares = _shares.add(_amount)` mints shares equal to raw deposit amount and withdrawal burns pro-rata to `balance()`, with no per-token price oracle; test config included 3crv_token alongside stablecoins, revealing the price mismatch.
**Exploitation:** Deposit a stablecoin into the vault to receive shares, then withdraw the same share value in a higher-priced LP token (3CRV at ~1.01), bypassing the 0.1% withdrawalProtectionFee and capturing the spread; flash loans can scale the capital.
**Escalation:** Flash-loan scaling of deposit amount amplifies the arbitrage spread against depositors.
**Insight:** When a vault accepts multiple assets and mints shares by raw amount, check whether any accepted asset is an LP or yield-bearing token whose market price deviates from 1; the spread becomes a no-slippage swap against other depositors.