# Exploiter can avoid negative Lido rebases stealing funds from EUSD vaults

Lybra vault records exact stETH deposit amount ignoring negative rebases, letting users sandwich a rebase to withdraw more shares than deposited, draining vault.

- Payout: Contest reward
- Severity: medium
- Program: Lybra Finance
- Credited: georgypetrov
- Disclosed: 2023-08-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-06-lybra-findings/issues/931
- Library page: https://bugbountylibrary.com/r/c4%3A2023-06-lybra%3AM-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LybraStETHDepositVault / LybraEUSDVaultBase stETH collateral accounting
**Root cause:** Vault stores the exact deposited stETH amount rather than shares, so negative Lido rebases reduce share value without reducing recorded deposit; withdrawal returns the original stETH amount, transferring more shares than deposited.
**Steps:**
1. Deposit stETH via `depositAssetToMint(exploiterBalance, toBorrow)` before a negative rebase.
2. Negative rebase occurs (bufferedEther set to 0 in PoC), lowering stETH share price.
3. Either wait 3 days then `withdraw(exploiter, exploiterBalance)`, or call `becomeRedemptionProvider(true)` and `rigidRedemption(exploiter, toBorrow)` to skip the wait with a discounted fee.
4. Withdraw full recorded deposit; receive more shares than deposited, vault absorbs the loss.
**How found:** Observed that LybraEUSDVaultBase records exact deposited asset amounts (lines 79, 103) rather than shares, and reasoned that rebase-driven share price changes would desync recorded deposits from actual shares.
**Exploitation:** Attacker sandwiches a negative Lido rebase: deposits stETH, waits for rebase (or uses rigidRedemption self-redemption to bypass the 3-day lock with a reduced fee), then withdraws the same stETH amount, receiving more shares than deposited and shifting the rebase loss onto the protocol.
**Insight:** When a vault tracks rebasing-token deposits by nominal amount instead of shares, any rebase (positive or negative) creates a deposit/withdraw sandwich opportunity; check whether redemption paths like rigidRedemption let attackers bypass lockups to time the rebase.