# Vault.balance() mixes normalized and standard amounts

Vault.balance() adds 18-decimal-normalized token balances to a raw non-normalized controller balance, under-reporting vault value and mispricing deposit/redeem shares.

- Payout: Audit contest
- Severity: high
- Program: yAxis
- Found by: cmichel
- Disclosed: 2021-11-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-yaxis-findings/issues/132
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AH-07
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** Vault.balance() / balanceOfThis accounting in Solidity vault contract
**Root cause:** balanceOfThis normalizes each token balance to 18 decimals via _normalizeDecimals, but the second term IController.balanceOf() returns raw token amounts (e.g. 6-decimal USDC) and is added without normalization.
**Steps:**
1. Read Vault.balance(): first term sums _normalizeDecimals(_token, IERC20(_token).balanceOf(this)) to 18 decimals.
2. Observe second term IController(manager.controllers(this)).balanceOf() uses _vaultDetails[msg.sender].balance, raw un-normalized amounts.
3. Add a 6-decimal token (USDC) to the vault so normalized and raw terms differ by 1e12.
4. Call deposit/redeem and observe share amounts computed from the under-reported balance().
**How found:** Code reading of balance()/balanceOfThis: noticed _normalizeDecimals applied to one term but not the other, and traced the controller balanceOf to raw _vaultDetails balance.
**Exploitation:** Attacker deposits or redeems against a vault holding low-decimal tokens (e.g. USDC); because balance() under-reports total assets, share pricing is skewed, letting the attacker receive incorrect (favorable) shares or redeem excess tokens.
**Insight:** In multi-token vaults, audit every arithmetic site that combines balances from different sources for consistent decimal normalization; a single un-normalized term silently skews share pricing.