# If the strategy incurs a loss the Active Pool will stop working until the shortfall is paid out entirely

ActivePool._rebalance underflows when the Reaper vault strategy incurs any loss, permanently bricking rebalancing until the shortfall is repaid.

- Payout: Contest reward
- Severity: medium
- Program: Ethos Reserve
- Credited: GalloDaSballo
- Disclosed: 2023-05-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-02-ethos-findings/issues/632
- Library page: https://bugbountylibrary.com/r/c4%3A2023-02-ethos%3AM-08
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** ActivePool._rebalance / ReaperVaultV2 yield strategy
**Root cause:** _rebalance computes profit as sharesToAssets.sub(currentAllocated), assuming vault share value never drops below recorded allocation; any loss makes sharesToAssets < currentAllocated and the SafeMath subtraction reverts.
**Steps:**
1. Deploy MockToken, ReaperVaultV2, MockActivePool with 20% yielding percentage.
2. depositColl(1e18) then manualRebalance to allocate 20% into vault.
3. Call vault.triggerLoss(1e17) to simulate a 20% loss; convertToAssets drops.
4. Call pool.manualRebalance again — reverts with Integer overflow at `vars.profit = vars.sharesToAssets.sub(vars.currentAllocated)`.
**How found:** Read the vault code comment acknowledging losses are possible and the bounty scope explicitly inviting loss-scenario analysis; then traced _rebalance's profit subtraction and realized currentAllocated (recorded deposit) can exceed sharesToAssets after a loss, causing underflow.
**Insight:** When a contract tracks a recorded allocation separately from a live share-to-asset conversion, audit every subtraction between them for the loss case — vaults/strategies that can be slashed or restructured break accounting invariants that assume monotonic growth.