# Wrong formula of getSharesForAmount() can potentially cause fund loss when being used to calculate the shares to be used in withdraw()

Collateral.getSharesForAmount() uses totalAssets() (which includes idle baseToken) instead of strategyController.totalValue(), so integrators computing shares for withdraw() get fewer tokens than expected.

- Payout: Audit contest
- Severity: medium
- Program: prePO
- Found by: WatchPug
- Disclosed: 2022-05-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-03-prepo-findings/issues/81
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-prepo%3AM-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** Collateral.sol ERC4626-style share/asset conversion getters
**Root cause:** getSharesForAmount()/getAmountForShares() divide by totalAssets() = baseToken.balanceOf(Collateral) + strategyController.totalValue(), but withdraw() computes owed using only strategyController.totalValue(), so the getters disagree with actual withdrawal math.
**Steps:**
1. Set state: baseToken.balanceOf(Collateral)=90, strategyController.totalValue()=110, totalSupply=100.
2. totalAssets() returns 200.
3. getSharesForAmount(100) returns (100*100)/200 = 50.
4. Call withdraw(50): owed = (110*50)/100 = 55, not 100.
5. Integrator relying on getter sends 50 shares expecting 100 baseToken but receives 55.
**How found:** Code reading: noticed getters use totalAssets() while withdraw() uses _strategyController.totalValue(), and totalAssets() adds idle baseToken balance, creating a mismatch.
**Exploitation:** An integrating contract that trusts getSharesForAmount() to size shares for a target withdrawal amount under-delivers baseToken to its users, causing fund loss proportional to the idle-balance discrepancy.
**Insight:** When a vault exposes share/asset conversion getters, verify they use the same denominator as the actual deposit/withdraw paths; idle token balances included in totalAssets() but excluded from withdrawal math create silent mispricing for integrators.