# Accounted balance of GlpStrategy does not match withdrawable balance, allowing for attackers to steal unclaimed rewards

GlpStrategy._currentBalance omits unclaimed GLP rewards, so share pricing undervalues the strategy and depositors can harvest rewards they didn't earn.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: kaden
- Disclosed: 2023-11-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/932
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-43
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:reward-distribution

**Target:** Yieldbox GlpStrategy vault share accounting
**Root cause:** _currentBalance only returns the GLP token balance of the strategy and ignores unclaimed rewards, so share minting is priced below the strategy's true value.
**Steps:**
1. Deposit into GlpStrategy while unclaimed rewards exist; shares are minted against _currentBalance which excludes those rewards, so attacker gets more shares than fair.
2. Trigger harvest so _currentBalance increases to include the previously unclaimed rewards.
3. Withdraw all shares; attacker redeems at the now-higher share price, capturing a proportional cut of rewards they did not accrue.
**How found:** Code review of Yieldbox depositAsset share math and GlpStrategy._currentBalance, noticing the balance getter ignores unclaimed rewards that later get realized on harvest.
**Exploitation:** Attacker times a large deposit before harvest, receives shares priced without pending rewards, then harvests and withdraws to capture a disproportionate share of the unclaimed rewards; profit scales with deposit size relative to strategy balance.
**Insight:** When a vault prices shares off a strategy's currentBalance, check whether that getter includes pending/accrued-but-unclaimed yield; any lag between accrual and realization is a deposit-then-harvest arbitrage.