# Users who deposit in one vault can lose all deposits and receive nothing when counterparty vault has no deposits

In Y2k Finance, if only one of the hedge/risk vaults has deposits, triggerDepeg sets the funded vault's claimTVL to 0, so depositors withdraw nothing and lose all funds.

- Payout: Contest reward
- Severity: high
- Program: Y2k Finance
- Credited: rbserver
- Disclosed: 2023-01-09
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-09-y2k-finance-findings/issues/312
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-y2k-finance%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Controller.triggerDepeg / Vault.withdraw / beforeWithdraw (Solidity contracts)
**Root cause:** triggerDepeg sets each vault's claimTVL to the counterparty's finalTVL; when the counterparty vault is empty its finalTVL is 0, so the funded vault's claimTVL becomes 0 and beforeWithdraw computes entitledAmount = 0.
**Steps:**
1. Create a market via vaultFactory.createNewMarket.
2. Deposit only into the risk vault (or only the hedge vault) for an epoch; leave counterparty vault empty.
3. Warp past epoch start and call controller.triggerDepeg(marketIndex, epochEnd).
4. Observe insrVault.setClaimTVL(epochEnd, riskVault.idFinalTVL) = 0 for the funded vault.
5. Call Vault.withdraw(epochEnd, assets, user, user); beforeWithdraw returns 0 entitledAmount and user receives nothing.
**How found:** Code review of triggerDepeg's symmetric setClaimTVL/sendTokens calls, noticing that an empty counterparty vault yields finalTVL 0 and thus zeroes the funded vault's claim, then confirming with Foundry PoC tests for both risk-only and hedge-only deposits.
**Exploitation:** No attacker action needed; the funded vault's tokens are transferred to the empty counterparty vault via sendTokens while the depositor's claimTVL is zeroed, so the depositor withdraws 0 and their deposit is stranded in the counterparty vault.
**Insight:** In paired-vault/pool designs, audit the settlement path for the degenerate case where one side has zero TVL: symmetric cross-assignment of claim/final TVL silently zeroes the funded side. Write PoCs for single-sided deposits.