# Withdrawers can get more value returned than expected with reentrant call

Reentrant callback in Vault.withdraw lets attacker re-deposit mid-withdrawal, inflating _totalUnderlyingMinusSponsored so they withdraw more UST than their shares allow.

- Payout: Audit contest
- Severity: high
- Program: Sandclock
- Found by: camden
- Disclosed: 2022-02-23
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-01-sandclock-findings/issues/32
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-sandclock%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:reentrancy

**Target:** Vault.sol withdraw / onDepositBurned callback
**Root cause:** Withdraw burns shares and calls claimer's onDepositBurned before transferring underlying; the callback can re-deposit, changing _totalUnderlyingMinusSponsored used to compute the payout.
**Steps:**
1. Vault holds 100 UST; attacker makes two 100 UST deposits and waits until withdrawable.
2. Attacker calls withdraw on one deposit position.
3. Execution reaches Vault.sol#L565 where claimer.onDepositBurned is invoked (shares already reduced, UST not yet sent).
4. Inside onDepositBurned, attacker re-enters and deposits another 100 UST.
5. Vault computes withdrawal amount at Vault.sol#L618 using inflated _totalUnderlyingMinusSponsored (300).
6. Attacker receives more UST than their shares entitled them to.
**How found:** Code reading of the withdraw flow: noticed onWithdraw reduces shares before the underlying transfer, and that the claimer callback fires in that window, then hypothesized re-depositing there would skew _totalUnderlyingMinusSponsored.
**Exploitation:** Attacker controls the claimer contract, so the onDepositBurned callback is attacker code. By re-depositing during the callback window between share burn and UST transfer, they manipulate the total-underlying accounting used for the payout calculation, extracting excess UST from the vault.
**Insight:** In vault-style contracts, any external callback between share accounting and asset transfer is a reentrancy surface; check whether state read for payout (total underlying) can be mutated by the callback via deposit/mint.