# Late users will take more losses than expected when the underlying contract (EthAnchor) suffers investment losses

Sandclock Vault share math inflates depositShares when strategy PPS drops, so late withdrawers absorb disproportionate losses while early users exit whole.

- Payout: Audit contest
- Severity: medium
- Program: Sandclock
- Found by: WatchPug
- Disclosed: 2022-02-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-sandclock-findings/issues/156
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-sandclock%3AM-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:share-inflation

**Target:** Vault.sol withdraw share computation
**Root cause:** When underlying loses value, share/underlying ratio rises, so computed depositShares = depositAmount * share / underlying inflates while totalShares stays fixed, making sum(depositShares) > totalShares.
**Steps:**
1. Deposit d1=100e18 (c1), d2=100e18 (c2), d3=100e18 (c2); totalShares=300e36
2. AUST PPS drops 50%: totalUnderlyingMinusSponsored 300e18 -> 150e18
3. c2 withdraws d2: depositShares = 300e36 * 100e18 / 150e18 = 200e36
4. c2 claimerShares 200e36 -> 0, totalPrincipal 200e18 -> 100e18, totalShares 300e36 -> 100e36
5. Transfer 100e18 to d2; remaining underlying 50e18 for last user
**How found:** Code reading of withdraw share math; noticed codebase already handles depositShares > claimerShares, hypothesized loss scenario and traced share accounting numerically.
**Exploitation:** No attacker; loss scenario causes last withdrawers to lose all funds while first users recover 100% of deposits.
**Insight:** When a vault's share price can decrease, recomputing shares from current PPS at withdrawal breaks the invariant sum(depositShares) <= totalShares; track cumulative losses separately to keep the ratio stable.