# Setting new controller can break YVaultLPFarming

yVaultLPFarming underflows when vault.balanceOfJPEG drops below previousBalance after a controller swap, bricking all withdrawals.

- Payout: Audit contest
- Severity: high
- Program: JPEG'd
- Credited: cmichel
- Disclosed: 2022-06-10
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-04-jpegd-findings/issues/80
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-jpegd%3AH-06
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** yVaultLPFarming / yVault controller accounting
**Root cause:** yVaultLPFarming._computeUpdate computes newRewards = currentBalance - previousBalance without guarding currentBalance >= previousBalance; a new controller returning a smaller balanceOfJPEG makes the subtraction underflow and revert.
**Steps:**
1. Owner calls `yVault.setController(newController)` where newController.balanceOfJPEG returns a smaller value than the old controller.
2. `vault.balanceOfJPEG()` now returns a lower number, so `currentBalance = vault.balanceOfJPEG() + jpeg.balanceOf(address(this))` < `previousBalance`.
3. Any call to `_computeUpdate` (triggered by `withdraw`/`deposit`) executes `currentBalance - previousBalance` and reverts on underflow.
4. All withdraw functions revert, locking user funds in the farming contract.
**How found:** Code reading of the accrual math in _computeUpdate and the setController/balanceOfJPEG path, noticing the unchecked subtraction depends on an externally-controlled controller value.
**Exploitation:** Not an attacker-driven exploit; triggered by an owner action (controller migration) that reduces balanceOfJPEG, permanently reverting accruals and blocking withdrawals.
**Insight:** When reward accounting subtracts a stored previousBalance from a live external balance, check whether any admin setter (controller, oracle, strategy) can lower that external value; an unchecked subtraction then bricks all functions that call _update first.