# updateStrategyAllocBPS() can cause loss of ActivePool's collateral during an emergency exit

Strategist can reverse a Guardian's emergency-exit revokeStrategy via updateStrategyAllocBPS, inflating vault share price and causing ActivePool to book phantom profit distributed to Treasury/Staking/Stability pools.

- Payout: Contest reward
- Severity: medium
- Program: Ethos Reserve
- Credited: peakbolt
- Disclosed: 2023-05-02
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-02-ethos-findings/issues/255
- Library page: https://bugbountylibrary.com/r/c4%3A2023-02-ethos%3AM-11
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:chained technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic

**Target:** ReaperVaultV2 / ReaperBaseStrategyv4 strategy allocation and ActivePool rebalance
**Root cause:** updateStrategyAllocBPS() lets a lower-privileged Strategist set a non-zero allocBPS after setEmergencyExit() revoked the strategy, reducing strategy debt and recording incorrect profit during harvest; vault totalAllocated then diverges from token balance, inflating share price.
**Steps:**
1. Guardian calls `strategy.setEmergencyExit()` -> vault `revokeStrategy()` sets allocBPS=0.
2. Strategist calls `vault.updateStrategyAllocBPS(strategy, 10000)` restoring 100% allocation.
3. Strategy `harvest()` liquidates positions but records incorrect profit due to reduced debt; fee (1.56 WBTC) sent to Treasury.
4. Vault share price inflated; ActivePool's owned asset value in vault inflated to ~17.43 WBTC from 10 WBTC deposit.
5. ActivePool `_rebalance()` (triggered via `sendCollateral`) books ~7.43 WBTC phantom profit, distributing to Treasury/StabilityPool/LQTYStaking.
6. Depositors/stakers withdraw profits, draining ActivePool collateral.
**How found:** Code reading of role permissions: noticed setEmergencyExit is irreversible by design but updateStrategyAllocBPS (callable by Strategist) can restore allocBPS, reversing revokeStrategy and corrupting debt/profit accounting.
**Exploitation:** Requires Strategist role (lower privilege than Guardian). After Guardian triggers emergency exit, Strategist restores allocBPS, harvest records phantom profit, share price inflates, ActivePool rebalance distributes phantom profit to Treasury/Stability/Staking pools which can be withdrawn, causing loss of borrower collateral.
**Escalation:** Privilege mismatch: lower-privileged Strategist undoes Guardian's irreversible emergency exit, chaining into vault accounting error and ActivePool profit distribution.
**Insight:** When a privileged emergency action is meant to be irreversible, check every lower-privileged setter that touches the same state variable (here allocBPS) for a path that undoes it; also audit accounting invariants between totalAllocated and actual token balance after such reversals.