# yVaultLPFarming: No guarantee JPEG currentBalance > previousBalance

yVaultLPFarming assumes JPEG balance only grows; a farm migration makes currentBalance < previousBalance, underflowing and bricking all deposits and withdrawals.

- Payout: Audit contest
- Severity: high
- Program: JPEG'd
- Credited: hickuphh3
- Disclosed: 2022-06-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-04-jpegd-findings/issues/56
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-jpegd%3AH-05
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** yVaultLPFarming Solidity farming contract
**Root cause:** _update() computes currentBalance - previousBalance without checking currentBalance >= previousBalance; if the vault's claimable JPEG drops (e.g. farm migration), the subtraction underflows and reverts.
**Steps:**
1. Deploy yVault + yVaultLPFarming; deposit LP and approve farm.
2. Mint JPEG to strategy, deposit twice so second deposit triggers _update() recording previousBalance.
3. Call `yVault.setFarmingPool(user1)` then `yVault.withdrawJPEG()` to migrate farm, moving JPEG out.
4. Call `lpFarming.deposit(units(500))` or `withdraw(units(500))`; both revert with panic 0x11 arithmetic underflow.
**How found:** Code review of _update() balance accounting; noticed the unchecked subtraction assumes monotonic JPEG balance and hypothesized migration/strategy scenarios breaking it, confirmed via Foundry test.
**Exploitation:** No direct theft; a farm/strategy migration or fee on claimed JPEG makes currentBalance < previousBalance, causing permanent revert (DoS) on deposit and withdraw for all users of the old farm, locking funds.
**Insight:** In vault/farm accounting, any `current - previous` delta assumes monotonic growth; check every place a strategy or farm can be swapped or charged a fee, since that breaks the invariant and bricks share accounting.