# DOS by directly transferring assets to Reaper Vault

Direct WBTC donation to ReaperVault inflates share price, causing withdraw rounding-up to over-withdraw and underflow ActivePool._rebalance, bricking all BorrowerOperations.

- Payout: Contest reward
- Severity: medium
- Program: Ethos Reserve
- Credited: gjaldon
- Disclosed: 2023-05-02
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-02-ethos-findings/issues/246
- Library page: https://bugbountylibrary.com/r/c4%3A2023-02-ethos%3AM-13
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:race-window technique:source-review vuln:accounting-error vuln:dos

**Target:** ActivePool._rebalance / ReaperVaultERC4626 withdraw accounting
**Root cause:** ReaperVaultERC4626.previewWithdraw rounds shares up, so withdrawing a small asset amount returns more assets than accounted; ActivePool's sharesToAssets then falls below yieldingAmount, underflowing profit = sharesToAssets.sub(currentAllocated).
**Steps:**
1. Set yieldingPercentage for collateral to 1000 (10%) and yieldClaimThreshold to 10000.
2. Alice opens a trove so ActivePool deposits into ReaperVault.
3. Bob submits openTrove with 190e3 WBTC collateral.
4. Alice frontruns by transferring 1 + expected ActivePool deposit amount of WBTC directly to ReaperVault.
5. Bob's openTrove triggers _rebalance with netAssetMovement = -1, calling withdraw(1).
6. previewWithdraw rounds up shares, withdrawing ~15 units of WBTC; sharesToAssets now < currentAllocated.
7. Subsequent _rebalance calls revert on underflow; closeTrove/openTrove all revert.
**How found:** Code review of ActivePool._rebalance accounting vs ReaperVaultERC4626.previewWithdraw rounding direction; noticed withdraw rounds up and that direct transfers to the vault change share price, desyncing sharesToAssets from yieldingAmount.
**Exploitation:** Attacker needs only WBTC to donate (recoverable via vault shares) and frontruns any openTrove. Donation of 1 unit above the pending deposit makes netAssetMovement -1; withdraw(1) rounds up to withdraw a full share's worth of assets, desyncing ActivePool accounting and permanently bricking rebalance until team donates more, which attacker can repeat.
**Escalation:** Repeatable: after team patches by donating assets, attacker re-donates to re-trigger DOS.
**Insight:** When a protocol tracks its own 'allocated' balance against an ERC4626 vault, any external donation changes share price; check whether previewWithdraw rounds up and whether the delta between actual withdrawn assets and internal accounting can underflow a subtraction.