# AdpaterBase.harvest should be called before deposit and withdraw

Popcorn AdapterBase harvests yield after computing deposit/withdraw shares, letting new depositors dilute existing yield and withdrawers lose earned yield.

- Payout: Contest reward
- Severity: medium
- Program: Popcorn
- Credited: rvierdiiev
- Disclosed: 2023-09-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-popcorn-findings/issues/302
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-popcorn%3AM-25
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** AdapterBase.sol vault adapter (Solidity)
**Root cause:** deposit/withdraw compute share amounts before calling harvest(); harvest can increase totalAssets via strategyDeposit, so the share price used is stale.
**Steps:**
1. Adapter holds totalAssets X; strategy has earned yield Y not yet deposited.
2. User calls deposit()/withdraw(); share amount computed against X (pre-harvest).
3. harvest() runs afterward, calling strategyDeposit and raising totalAssets to X+Y.
4. New depositor's shares are priced at X, diluting prior depositors; withdrawer's shares priced at X, losing their share of Y.
**How found:** Code reading of AdapterBase: noticed harvest() invoked at line 232 after share calculation, and that harvest can call strategyDeposit increasing totalAssets.
**Exploitation:** Not an external attack; value transfer occurs whenever a deposit/withdraw lands in the window before harvest, shifting yield between users.
**Insight:** In vault adapters, check ordering of state-changing accounting calls (harvest/accrue) relative to share-price reads; any yield realization after pricing creates a dilution window.