# Malicious Users Can Drain The Assets Of Vault. (Due to not being ERC4626 Complaint)

Popcorn vault withdraw rounds shares down, so a user withdrawing a small asset amount burns zero shares and drains vault assets.

- Payout: Contest reward
- Severity: medium
- Program: Popcorn
- Credited: fs0c
- Disclosed: 2023-09-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-popcorn-findings/issues/471
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AM-17
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** ERC4626 vault withdraw/mint share conversion
**Root cause:** convertToShares uses Math.Rounding.Down in withdraw (and mint), so small asset amounts round to zero shares burned while assets are still paid out.
**Steps:**
1. Vault state: totalAssets=1000 WETH, totalSupply=10 shares.
2. Call `Vault.withdraw(99 WETH, receiver, owner)`.
3. shares = convertToShares(99) = 99*10/1000 = 0 (rounded down).
4. Zero shares burned, 99 WETH returned to user; repeat to drain vault.
**How found:** Code review of withdraw/convertToShares against the ERC4626 spec's required rounding directions (OZ reference: withdraw should round up).
**Exploitation:** Attacker repeatedly calls withdraw with asset amounts small enough that assets*supply/totalAssets rounds to zero, receiving assets while burning no shares until the vault is drained.
**Insight:** When auditing ERC4626 vaults, check each of deposit/mint/withdraw/redeem against OZ's mandated rounding directions; a single Rounding.Down in withdraw lets small withdrawals burn zero shares.