# Vault is not compatible with some ERC4626 vaults

PoolTogether Vault derives exchange rate from yieldVault.maxWithdraw, so ERC4626 vaults with borrow/withdraw limits report less than real balance, causing depositor losses.

- Payout: Contest reward
- Severity: high
- Program: PoolTogether
- Credited: rvierdiiev
- Disclosed: 2023-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-pooltogether-findings/issues/79
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AH-09
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** pt-v5-vault Vault.sol _currentExchangeRate / _convertToShares
**Root cause:** _currentExchangeRate uses _yieldVault.maxWithdraw(address(this)) as the asset backing, but maxWithdraw can return less than the actual balance for ERC4626 vaults that borrow funds or enforce withdraw limits, lowering the recorded exchange rate.
**Steps:**
1. Deploy Vault with a yield vault like DnGmxSeniorVault that borrows deposits or caps withdrawals.
2. User deposits; _convertToShares calls _currentExchangeRate.
3. _currentExchangeRate calls _yieldVault.maxWithdraw(address(this)), which returns less than the real balance due to borrowing percentage or withdraw limit.
4. Rate is computed below 1 and stored as _lastRecordedExchangeRate.
5. Depositors withdraw at the depressed rate and lose funds; rate recovers to 1 only after debt is repaid.
**How found:** Code reading of _currentExchangeRate and noticing it trusts maxWithdraw as the full backing amount; compared against ERC4626 vaults like DnGmxSeniorVault that borrow deposits and cap withdrawals.
**Exploitation:** Not an active attack; a depositor or the vault creator triggers loss by using an incompatible ERC4626 yield vault whose maxWithdraw underreports balance, causing redemptions at a depressed exchange rate.
**Insight:** When integrating ERC4626 vaults, don't treat maxWithdraw as the true asset balance—it reflects liquidity/limits, not solvency. Check whether the yield source borrows or caps withdrawals before using it as backing.