# Inactive skipped assets can be drained from the index

Mint logic excludes SKIPPED_ASSET_ROLE assets from deposit checks but burn logic only skips them when blacklisted, letting users repeatedly withdraw skipped assets they never deposited.

- Payout: Audit contest
- Severity: medium
- Program: Phuture Finance
- Found by: IllIllI
- Disclosed: 2022-02-11
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-04-phuture-findings/issues/54
- Library page: https://bugbountylibrary.com/r/c4%3A2022-04-phuture%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** IndexLogic.sol index mint/burn contract
**Root cause:** Mint loop skips SKIPPED_ASSET_ROLE assets when computing deposited balances, but burn loop only skips them when containsBlacklistedAssets is true, so skipped assets are paid out on withdrawal despite never being counted on deposit.
**Steps:**
1. Index has inactive asset with SKIPPED_ASSET_ROLE.
2. Call mint: skipped asset excluded from lastAssetBalanceInBase check, so no deposit of it required.
3. Call burn: containsBlacklistedAssets false, so skipped asset not skipped; accountBalance computed from vToken balance and transferred/burned to recipient.
4. Repeat mint/burn to drain skipped asset balance from index.
**How found:** Code review comparing the mint loop's SKIPPED_ASSET_ROLE exclusion against the burn loop's condition, noticing the burn only skips when containsBlacklistedAssets is set, indicating an asymmetric check.
**Exploitation:** Repeatedly mint and burn index shares; each burn returns a pro-rata share of the skipped asset's vToken balance without the user ever having deposited it, draining the index's skipped-asset holdings.
**Insight:** When a protocol has multiple loops over the same asset set (deposit vs withdraw), diff the skip/continue conditions between them; an asymmetric role check on one side lets value flow out without matching inflow.