# PublicVault.processEpoch updates YIntercept incorrectly when totalAssets() <= expected

PublicVault.processEpoch always decrements yIntercept by totalAssets*liquidationWithdrawRatio even when totalAssets<=expected and withdrawReserve is zero, corrupting accounting.

- Payout: Contest reward
- Severity: medium
- Program: Astaria
- Credited: rvierdiiev
- Disclosed: 2023-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/124
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AM-29
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** PublicVault.processEpoch epoch accounting (Solidity)
**Root cause:** _setYIntercept is called unconditionally after the branch, subtracting totalAssets()*liquidationWithdrawRatio from yIntercept even when totalAssets()<=expected and no funds are actually reserved for the withdraw proxy.
**Steps:**
1. Deploy PublicVault with a WithdrawProxy for current epoch where getExpected() >= totalAssets().
2. Advance time past epoch end; ensure withdrawReserve==0 and liensOpenForEpoch==0.
3. Call `processEpoch()`; observe withdrawReserve set to 0 but yIntercept decremented by `totalAssets().mulDivDown(liquidationWithdrawRatio,1e18)`.
4. Compare yIntercept before/after to confirm incorrect reduction despite no asset transfer.
**How found:** Code reading of processEpoch: noticed the unchecked branch sets withdrawReserve=0 when totalAssets()<=expected, but the following _setYIntercept call is outside the branch and still subtracts totalAssets()*ratio.
**Exploitation:** Accounting corruption: yIntercept is reduced without corresponding asset outflow, mispricing vault shares/interest for subsequent epochs; no direct theft path described.
**Insight:** When a state variable is updated after a conditional that zeroes a related value, check whether the update should be gated by the same condition; here the reserve branch and the yIntercept update must stay consistent.