# AaveVault does not update TVL on deposit/withdraw

AaveVault mints LP shares against stale cached TVL, letting an attacker deposit, trigger TVL update, and withdraw to capture accrued Aave interest risk-free.

- Payout: Audit contest
- Severity: high
- Program: Mellow Protocol
- Found by: cmichel
- Disclosed: 2022-02-09
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-12-mellow-findings/issues/41
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-mellow%3AH-04
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** AaveVault LP issuance / TVL accounting
**Root cause:** AaveVault.tvl is a cached value only refreshed via updateTvls; deposit/withdraw paths compute LP shares from the stale cached TVL while rebasing aToken balances have already grown with interest.
**Steps:**
1. Vault holds 1,000 aTokens, cached tvl=1000, interest accrued since last update.
2. Attacker calls `LPIssuer.push([1000])` which reads old cached tvl.
3. `aaveVault.transferAndPush([1000])` deposits 1000 underlying, returns actualTokenAmounts=[1000], and updates `_tvls` to include interest + 1000.
4. LP minted = 1000/oldTvl = 100% of existing supply.
5. Attacker withdraws LP for ~50% of new TVL = 1000 + 0.5*interest, profiting 0.5*interest.
**How found:** Noticed Aave uses rebasing aTokens whose balanceOf grows over time, while AaveVault.tvl is a cached value only refreshed by updateTvls; observed deposit path mints LP against the stale cached tvl before transferAndPush updates _tvls.
**Exploitation:** Single-transaction, risk-free: flashloan large amount, deposit to mint LP at stale TVL, let transferAndPush refresh _tvls with accrued interest, then withdraw LP to redeem a share of the inflated TVL, capturing a portion of the interest.
**Escalation:** Scale with flashloan size and low vault activity to maximize accrued interest captured.
**Insight:** When a vault caches TVL but holds rebasing tokens (aTokens, stETH-like), check whether share-mint math reads the cache before the refresh call in the same deposit path; the ordering of read-then-update is the exploitable window.