# Unused funds are not returned and not counted in GeVault

GeVault.depositAndStash ignores unspent tokens returned by TokenisableRange.deposit; leftover funds are locked and excluded from getTVL, causing depositor losses on withdraw.

- Payout: Contest reward
- Severity: high
- Program: Good Entry
- Credited: Jeiwan
- Disclosed: 2023-10-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-08-goodentry-findings/issues/325
- Library page: https://bugbountylibrary.com/r/c4%3A2023-08-goodentry%3AH-02
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** GeVault / TokenisableRange Uniswap V3 liquidity vault
**Root cause:** TokenisableRange.deposit returns unspent tokens to GeVault, but depositAndStash does not forward them to the depositor nor account for them; getTVL only counts LP tokens, so idle tokens are invisible to share pricing.
**Steps:**
1. Call `GeVault.deposit(amount)`; funds are pulled and `rebalance()` runs.
2. `rebalance()` calls `removeFromAllTicks()` then `deployAssets()`, which splits amounts in halves and calls `depositAndStash()` per tick.
3. `TokenisableRange.deposit()` calls `POS_MGR.increaseLiquidity` and returns `n0-added0`/`n1-added1` to GeVault.
4. Because Uniswap V3 requires balanced amounts and GeVault splits 50/50, some tokens are returned unspent and remain in GeVault.
5. `getTVL()`/`getTickBalance()`/`latestAnswer()` only count LP liquidity, so the idle tokens are excluded from share price.
6. Withdraw computes payout from the understated TVL, so the depositor receives less than deposited; leftover tokens stay locked.
**How found:** Code reading of the deposit/rebalance/deployAssets/depositAndStash call chain, noticing TokenisableRange.deposit returns unspent tokens that GeVault ignores, then tracing getTVL/getTickBalance/latestAnswer to confirm the tokens are excluded from accounting.
**Exploitation:** No attacker action needed; any depositor whose funds are not fully consumed by the Uniswap pool suffers a partial loss on withdrawal because the unspent tokens are neither returned nor counted in TVL.
**Insight:** When a callee returns unspent tokens (Uniswap V3 increaseLiquidity pattern), verify the caller forwards or accounts for them; check that TVL/share-price functions include all token balances the contract can hold, not just LP positions.