# Users can get immediate profit when deposit and redeem in PerpetualAtlanticVaultLP

In PerpetualAtlanticVaultLP.deposit, shares are priced before updateFunding adds collateral, letting a depositor redeem same-block for instant profit.

- Payout: Contest reward
- Severity: high
- Program: Dopex
- Credited: said
- Disclosed: 2023-12-29
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-08-dopex-findings/issues/867
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-dopex%3AH-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:race-window technique:source-review vuln:business-logic

**Target:** PerpetualAtlanticVaultLP ERC4626-style vault (Solidity)
**Root cause:** deposit() computes shares via previewDeposit before calling perpetualAtlanticVault.updateFunding(), which transfers funding collateral into the LP and increases _totalCollateral; redeem() calls updateFunding() before pricing, so the same shares are redeemed against the inflated collateral.
**Steps:**
1. Call `vaultLp.deposit(1e18, address(this))`: shares minted using pre-funding totalCollateral.
2. Inside deposit, `perpetualAtlanticVault.updateFunding()` transfers funding to LP and calls `addProceeds`, raising _totalCollateral.
3. Immediately call `vaultLp.redeem(shares, address(this), address(this))` in same block; redeemPreview uses inflated totalCollateral.
4. Receive more assets than deposited; PoC shows ~0.0203 WETH profit per 1e18 deposit.
**How found:** Code-reading of deposit() ordering: noticed previewDeposit runs before updateFunding while redeem() runs updateFunding before redeemPreview, an asymmetry that lets a depositor capture funding added after their share price was fixed.
**Exploitation:** Attacker times a deposit right before a funding update (or sandwiches the updateFunding call), deposits, lets updateFunding inflate totalCollateral, then redeems same block to capture a proportional share of the funding proceeds without holding shares during the accrual period.
**Escalation:** Repeatable each funding epoch and sandwichable by MEV bots, scaling profit with deposit size and funding amount.
**Insight:** In ERC4626-style vaults, check ordering of share-price computation vs. any state-mutating accrual (funding, fees, rewards) between deposit and redeem paths; asymmetry between the two paths is the tell.