# [Buyout module] Fraction price is not updated when total supply changes

Buyout module caches fractionPrice at auction start; a supply-changing module (e.g. split/mint) mid-buyout lets a holder sell a fraction of supply for the full buyout price.

- Payout: Contest reward
- Severity: medium
- Program: Fractional
- Credited: 0xA5DF
- Disclosed: 2022-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-07-fractional-findings/issues/337
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Buyout.sol module (start/sellFractions/buyFractions)
**Root cause:** Buyout stores fractionPrice = buyoutPrice/totalSupply at auction start and reuses it for buys/sells; if total supply changes via another module, the stored price no longer reflects real per-fraction value.
**Steps:**
1. Alice creates vault with a supply-changing (split/mint) module.
2. Bob calls `buyoutModule.start{value: 1 ether}(vault)`; fractionPrice cached against original supply.
3. Alice executes supply module to mint 3x TOTAL_SUPPLY to herself (x4 split).
4. Alice calls `buyoutModule.sellFractions(vault, TOTAL_SUPPLY)` — only 1/4 of new supply.
5. Alice receives full 1 ETH and retains 3/4 of fractions; Bob gets 25% of vault.
**How found:** Code reading of Buyout.sol: noticed fractionPrice is persisted in the Auction struct at start and reused in sellFractions/buyFractions, then reasoned that an extendable platform allows modules that mint/burn supply, invalidating the cached price.
**Exploitation:** Attacker controls a vault using a trusted-but-supply-changing module; starts or waits for a buyout, inflates supply, then sells a small fraction of the new supply to drain the buyout pool's ETH while keeping most fractions.
**Insight:** When a contract caches a derived price (price = pool/supply) at one point in time, check whether any external, composable module can mutate the denominator; extendable-module platforms must treat supply changes as in-scope.