# _amountOut is representing assets and shares at the same time in the liquidate function

PoolTogether Vault.liquidate mixes asset and share units for _amountOut, so yield-fee accounting and yield-vault deposit checks compare mismatched values.

- Payout: Contest reward
- Severity: high
- Program: PoolTogether
- Credited: Aymen0909
- Disclosed: 2023-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-pooltogether-findings/issues/427
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Vault.liquidate liquidation function
**Root cause:** _amountOut is treated as an asset amount when compared to _liquidableYield and _vaultAssets, but as a share amount when computing yield fee and minting shares, without _convertToAssets/_convertToShares conversion.
**Steps:**
1. Read Vault.liquidate: `_amountOut` compared to `_liquidableYield` (asset units) and `_vaultAssets` (asset units).
2. Same `_amountOut` passed to `_increaseYieldFeeBalance` and `_mint(_account, _amountOut)` as share units.
3. Observe no `_convertToAssets`/`_convertToShares` applied between the two uses.
4. Conclude liquidation can mint wrong share count and miscompute yield fee / skip yield-vault deposit.
**How found:** Code reading of liquidate: noticed the same variable compared against asset-denominated values (_liquidableYield, _vaultAssets) while also used as share-denominated (fee shares, _mint), and that no conversion function is applied.
**Exploitation:** Not described; audit finding only. A liquidator calling liquidate with an _amountOut sized in one unit causes the other-unit checks and mint to be inconsistent, mispricing shares and fee accounting.
**Insight:** In ERC4626-style vaults, trace every variable through the function and check whether it is compared against asset-denominated or share-denominated values; a single _amountOut used for both without _convertToAssets/_convertToShares is a unit-confusion bug.