# removeToken would break the vault/protocol.

Manager.removeToken lacks safety checks, so removing a vault token locks funds and crashes share price while totalSupply stays unchanged.

- Payout: Audit contest
- Severity: high
- Program: yAxis
- Found by: jonah1005
- Disclosed: 2021-11-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-yaxis-findings/issues/4
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AH-09
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:accounting-error

**Target:** Manager.sol removeToken / Vault share accounting
**Root cause:** Manager.removeToken deletes a token from a vault without withdrawing it from strategies/vault or reconciling Controller balances, so vault balance drops while totalSupply is unchanged.
**Steps:**
1. Deploy vault with DAI deposited; note `vault.balanceOfThis()` = 100000e18 and `totalSupply()` = 100000e18
2. Call `manager.removeToken(vault.address, dai.address)`
3. Observe `balanceOfThis()` returns 0 while `totalSupply()` remains 100000e18
4. Share price `totalValue/totalSupply` collapses; Controller.balanceOf still reports stale balance but users cannot withdraw
**How found:** Code review of Manager.removeToken found no safety checks; reasoned through vault/controller/share-price state to confirm impact, then verified with a web3.py script.
**Exploitation:** Admin/strategist calls removeToken on a live vault; tokens remain locked in vault/strategies, Controller accounting desyncs, and share price collapses to near zero, breaking withdrawals and vault economics.
**Insight:** When auditing admin functions that mutate asset lists, trace every downstream accounting consumer (share price, balanceOf, strategy holdings) to see which state is left stale after the mutation.