# The exchange rate change in the case of Lossy Strategy will cause the Vault to be under-collateralized for generic ERC4626 Yield Vaults

PoolTogether Vault computes burn shares from maxWithdraw before a lossy YieldVault withdrawal, so early withdrawers socialize losses onto remaining depositors.

- Payout: Contest reward
- Severity: medium
- Program: PoolTogether
- Credited: GalloDaSballo
- Disclosed: 2023-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-pooltogether-findings/issues/256
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-pooltogether%3AM-18
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:share-inflation

**Target:** ERC4626 PT Vault / YieldVault withdrawal accounting
**Root cause:** _convertToShares uses _currentExchangeRate based on yieldVault.maxWithdraw, a static view that does not reflect losses realized during the actual withdraw, so shares burned are computed pre-loss.
**Steps:**
1. Call `Vault.withdraw(assets)`; `_convertToShares(_assets, Rounding.Up)` computes shares using `_currentExchangeRate()` from `yieldVault.maxWithdraw(address(this))`.
2. PT Vault calls `YieldVault.withdraw` for the assets; the lossy strategy realizes a loss during this call.
3. More yieldVault shares are consumed than the pre-loss rate implied, but the user's PT shares were already fixed, socializing the loss onto remaining depositors.
**How found:** Code reading of `_convertToShares`/`_currentExchangeRate` and comparison against OZ/Yearn `maxWithdraw` implementations, noting maxWithdraw is a static view that cannot account for losses applied during withdraw.
**Exploitation:** Early withdrawer exits at a rate that ignores the pending loss, receiving full value while the loss is borne by laggards; repeatable by front-running loss realization.
**Insight:** When a vault prices shares off a downstream ERC4626 `maxWithdraw` view, check whether that view can diverge from the actual realized amount at withdrawal (lossy strategies, fees, slippage); the gap is a socialization/dilution vector favoring early exiters.