# Vault: Swaps at parity with swap fee = withdrawal fee

yAxis vault treats all accepted assets as equal price, letting users deposit and withdraw in one tx to swap vault funds at parity paying only the 0.1% withdrawal fee.

- Payout: Audit contest
- Severity: medium
- Program: yAxis
- Found by: hickuphh3
- Disclosed: 2021-11-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-yaxis-findings/issues/71
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-05
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** yAxis vault deposit/withdraw accounting
**Root cause:** Vault assumes all accepted assets share the same price and allows deposit and withdrawal in the same transaction, so shares are minted/redeemed at parity regardless of actual token price imbalances.
**Steps:**
1. Deposit an off-peg or cheaper accepted token into the vault to receive shares at parity value.
2. In the same transaction, withdraw a different, more valuable token held by the vault.
3. Pay only the 0.1% withdrawal protection fee, effectively swapping at parity.
**How found:** Researcher observed the vault treats all assets as equal price and that deposit+withdraw can occur in the same transaction, making the withdrawal protection fee the effective swap fee.
**Exploitation:** User deposits a depegged/cheaper accepted stablecoin and withdraws a stronger asset from vault reserves within one transaction, capturing the price difference minus the 0.1% withdrawal fee; flash loans can amplify capital.
**Escalation:** Flash loans can scale the parity swap since deposit and withdraw occur atomically in one transaction.
**Insight:** In multi-asset vaults, check whether deposit and withdraw can happen atomically and whether share pricing assumes parity across assets; the withdrawal fee then becomes an arbitrage fee against off-peg tokens.