# Yeti token rebase checks the additional token amount incorrectly

Yeti sYETI rebase caps additional balance against total token balance instead of newly bought-back tokens, over-crediting effectiveYetiTokenBalance and risking contract insolvency.

- Payout: Audit contest
- Severity: high
- Program: Yeti Finance
- Found by: hyh
- Disclosed: 2022-03-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-yetifinance-findings/issues/121
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-yetifinance%3AH-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** sYETIToken.sol rebase() / _getValueOfContract
**Root cause:** rebase() clamps additionalYetiTokenBalance against the full yetiToken.balanceOf instead of the delta (balance - effectiveYetiTokenBalance), so the rebase can add more than the tokens actually bought back.
**Steps:**
1. Read sYETIToken.rebase() at L247: `uint256 yetiTokenBalance = yetiToken.balanceOf(address(this));` then `if (yetiTokenBalance < additionalYetiTokenBalance) additionalYetiTokenBalance = yetiTokenBalance;`
2. Note _getValueOfContract subtracts effectiveYetiTokenBalance from the passed balance, so the cap should use the same adjusted amount
3. Observe additionalYetiTokenBalance can exceed (balance - effectiveYetiTokenBalance), inflating effectiveYetiTokenBalance beyond real holdings
4. Fix: clamp against `yetiToken.balanceOf(address(this)) - effectiveYetiTokenBalance`
**How found:** Code review of rebase accounting: noticed the clamp used the whole balance while _getValueOfContract internally subtracts effectiveYetiTokenBalance, an inconsistency between the check and the value computation.
**Escalation:** If YETI price rises versus lastBuybackPrice, users' cumulative claims exceed contract net holdings; enough withdrawals put the contract in default.
**Insight:** When a function both clamps an increment and computes value from a delta, verify the clamp uses the same delta; mismatched bases silently over-credit accounting state.