# StakedCitadel doesn't use correct balance for internal accounting

StakedCitadel's balance() omitted strategy holdings, so share minting/burning used a near-zero pool, letting a depositor mint inflated shares and drain others' funds.

- Payout: Audit contest
- Severity: high
- Program: BadgerDAO
- Found by: Ruhum
- Disclosed: 2022-07-08
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-04-badger-citadel-findings/issues/74
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-badger-citadel%3AH-01
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:share-inflation

**Target:** StakedCitadel vault contract (Solidity)
**Root cause:** balance() returns only the vault's own token balance instead of vault + strategy balance, so share price (pool) collapses to ~0 once funds are moved into the strategy.
**Steps:**
1. Fresh vault: 0 funds, 0 shares.
2. Alice deposits 10 tokens, gets 10 shares (`shares = amount * totalSupply / pool`).
3. Vault deposits tokens into strategy; now `balance()==0`, `totalSupply==10`.
4. Bob transfers 1 token directly to vault so `balance()==1`.
5. Bob deposits 5 tokens; `shares = 5 * 10 / 1 == 50`.
6. Bob now holds 50 of 60 shares for 5 of 15 tokens and can withdraw more than deposited.
**How found:** Code review of balance() against its own comment and a correctly implemented sibling Badger vault; noticed share math divides by balance() which excludes strategy funds.
**Exploitation:** Attacker waits until vault funds sit in strategy (balance()==0), donates 1 wei/token to the vault to avoid div-by-zero, then deposits to mint shares at an artificially low pool value, diluting existing depositors and withdrawing excess underlying.
**Insight:** When auditing ERC4626-style vaults, verify the share-price source aggregates all holdings (vault + strategies); any donation to the vault can then manipulate the denominator.