# Changing a strategy can be bricked

Anyone could send 1 wei aUST to a Sandclock strategy, making investedAssets() nonzero and blocking setStrategy replacement indefinitely.

- Payout: Audit contest
- Severity: medium
- Program: Sandclock
- Found by: kenzo
- Disclosed: 2022-02-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-sandclock-findings/issues/91
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-sandclock%3AM-11
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Vault/BaseStrategy smart contract (setStrategy, investedAssets)
**Root cause:** setStrategy requires strategy.investedAssets()==0, but investedAssets() reads the raw aUST balance plus pendingRedeems, which anyone can inflate by transferring aUST directly to the strategy.
**Steps:**
1. Identify a vault whose strategy is slated for replacement.
2. Send 1 wei of aUST directly to the strategy contract address.
3. Call setStrategy on the vault; it reverts because investedAssets() != 0.
4. Repeat after each redeem attempt; EthAnchor rejects redeems <10 aUST, forcing protocol to top up aUST to clear the dust.
**How found:** Code review of setStrategy's investedAssets()==0 check and tracing investedAssets to raw aUST balance + pendingRedeems, noting external transfers are unaccounted.
**Exploitation:** Griefer transfers minimal aUST to the strategy, blocking setStrategy; protocol must redeem aUST (min 10 aUST via EthAnchor) and wait, and attacker can re-dust to repeat.
**Insight:** When an invariant check reads a raw token balance, ask who can inflate that balance externally; dust transfers can permanently block state transitions gated on zero balance.