# Vault: Withdrawals can be frontrun to cause users to burn tokens without receiving funds in return

Multi-stablecoin vault lets an attacker frontrun a victim's withdrawal by draining the requested token, leaving the victim burning vault tokens for nothing.

- Payout: Audit contest
- Severity: medium
- Program: yAxis
- Found by: hickuphh3
- Disclosed: 2021-11-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-09-yaxis-findings/issues/74
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AM-07
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:chained vuln:business-logic vuln:race-condition

**Target:** yAxis multi-stablecoin vault withdrawal
**Root cause:** Vault holds multiple stablecoins and pays withdrawals in the caller's chosen token without checking the resulting share price or available balance, so a frontrunner can empty the requested token first.
**Steps:**
1. Vault holds 1000 USDC, 1000 USDT, 1000 DAI; getPricePerFullShare()=1e18; Alice has 1000 shares, Mallory 2000.
2. Alice submits withdraw for USDC.
3. Mallory frontruns: burns 1000 shares to withdraw all 1000 USDC.
4. Alice's tx executes; vault has no USDC, she burns shares and receives 0.
5. Mallory burns remaining 500 shares for 1000 USDT and 500 for 1000 DAI, capturing Alice's value.
**How found:** Reasoning about wind-down/zero-strategy states and the multi-stablecoin deposit feature: noted withdrawals pay a chosen token, so a frontrunner can deplete that token before the victim's tx lands.
**Exploitation:** Attacker monitors mempool for a victim withdrawal specifying a token, frontruns by withdrawing the entire balance of that token, then splits remaining shares across other stablecoins to extract value.
**Insight:** In multi-asset vaults, check whether withdrawal payout token selection is first-come-first-served; a mempool watcher can drain the requested asset ahead of the victim, so test share-price invariants across asset-specific withdrawals.