# Usage of BalancerStrategy.updateCache will cause single sided Loss, discount to Depositor and to OverBorrow from Singularity

BalancerStrategy caches a single-sided queryExit price, so sandwiching the Balancer pool inflates or discounts the strategy's BPT value, enabling over-borrowing and unfair liquidations.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: GalloDaSballo
- Disclosed: 2023-11-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/1447
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained vuln:accounting-error vuln:oracle-manipulation

**Target:** BalancerStrategy.sol (_currentBalance / updateCache) in Tapioca YieldBox strategies
**Root cause:** The strategy prices its BPT via vault.queryExit single-sided simulation and caches the result; pool imbalance from a swap directly changes that price, and _currentBalance is a view the YieldBox trusts without dispute.
**Steps:**
1. Imbalance the Balancer pool via a swap (Sandwich A) to move internal balances.
2. Call `updateCache()` so the manipulated single-sided queryExit price is cached.
3. Deposit into YieldBox; it reads the view `_currentBalance` using the manipulated cached value.
4. `_deposited` triggers another `updateCache()` at the skewed price.
5. Rebalance the pool (Sandwich B) and call `updateCache()` again to restore a higher rate.
6. Withdraw at a gain, or use inflated balance to over-borrow from Singularity.
**How found:** Noticed the strategy caches a single-sided queryExit valuation of its BPT and that _currentBalance is a view the YieldBox accepts without dispute, making the cached price directly manipulable by pool swaps.
**Exploitation:** Attacker sandwiches the Balancer pool around a YieldBox deposit/withdraw or a Singularity borrow: swap to skew pool balances, force updateCache via deposit, then unwind the swap and refresh the cache, extracting the difference from the strategy or borrowing beyond fair collateral value.
**Escalation:** Imbalance up enables over-borrowing and protocol insolvency; imbalance down enables unfair liquidation of borrowers at liquidator profit; sandwiching both directions steals user deposits.
**Insight:** When a strategy prices LP/BPT via single-sided queryExit and caches it, treat the cache as attacker-controllable: check whether deposit/withdraw/borrow paths read the cached view and can be sandwiched around the updateCache trigger.