# investedAssets() Does Not Take Into Consideration The Performance Fee Charged On Strategy Withdrawals

investedAssets() in Sandclock strategies omits the performance fee charged on finishRedeemStable withdrawals, letting users exit before fee accrual and reenter to dodge fees.

- Payout: Audit contest
- Severity: medium
- Program: Sandclock
- Found by: leastwood
- Disclosed: 2022-02-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-sandclock-findings/issues/66
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-sandclock%3AM-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:fee-bypass

**Target:** BaseStrategy/NonUSTStrategy vault strategy contracts (Anchor/UST)
**Root cause:** investedAssets() computes underlying value from aUst balance and exchange rate but does not subtract the performance fee that finishRedeemStable() deducts on profitable redemptions, so share price overstates net assets.
**Steps:**
1. Read BaseStrategy.finishRedeemStable: perfFee = (redeemedAmount - originalUst).percOf(perfFeePct) transferred to treasury.
2. Read investedAssets(): returns underlyingBalance + exchangeRate*aUstBalance/1e18 with no fee deduction.
3. Observe share value is inflated relative to post-fee assets.
4. Withdraw shares before finishRedeemStable calls execute, avoiding fee; reenter after fee is charged to capture the corrected (lower) price.
**How found:** Manual code review comparing the fee logic in finishRedeemStable() against the valuation logic in investedAssets() across BaseStrategy and NonUSTStrategy, spotting the missing fee deduction.
**Exploitation:** Attacker redeems/withdraws their vault position before pending finishRedeemStable operations realize profits and charge perfFee to treasury, then reenters after the fee is deducted, avoiding their share of the performance fee at other holders' expense.
**Insight:** When a protocol charges fees at settlement time, check whether the share-price/valuation function used for deposits and withdrawals accounts for those pending fees; any mismatch lets users time entries/exits around fee realization.