# earn results in decreasing share price

yAxis Vault and Controller value a vault differently, so each earn() call on a DAI/Curve3Crv vault drops share price ~2%, costing depositors money.

- Payout: Audit contest
- Severity: high
- Program: yAxis
- Found by: jonah1005
- Disclosed: 2021-11-10
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-09-yaxis-findings/issues/9
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AH-06
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** Vault/Controller accounting for DAI vault paired with NativeStrategyCurve3Crv
**Root cause:** Vault.getPricePerFullShare sums all token balances while Controller.balanceOf only counts strategy.want (t3crv) received, so the two contracts disagree on vault value and assume all coins have equal value.
**Steps:**
1. Deploy/use a DAI vault paired with NativeStrategyCurve3Crv
2. Read `vault.getPricePerFullShare()` (previous_price)
3. Call `vault.earn(dai.address, strategy.address)`
4. Read `vault.getPricePerFullShare()` again (current_price)
5. Observe current_price < previous_price (~2% loss per earn)
**How found:** Code reading comparing Vault.sol L293-303 valuation (sums all token balances) against Controller.sol L410-436 (only adds strategy.want), spotting the inconsistent balance-sheet semantics and the implicit assumption that all coins share equal value.
**Exploitation:** Repeated earn() calls on the mismatched vault progressively reduce share price, transferring value away from depositors; no attacker capital described, loss accrues to shareholders.
**Insight:** When a vault and its controller each compute 'balance' independently, diff the two formulas: any token the strategy holds that isn't the want token gets valued differently, and repeated harvest/earn calls leak that delta from share price.