# Investors claiming their maxDeposit by using the LiquidityPool.deposit() will cause other users to be unable to claim their maxDeposit/maxMint

Rounding in Centrifuge's averaged deposit price lets one investor's claim transfer slightly more tranche shares from Escrow, reverting other investors' maxDeposit/maxMint claims.

- Payout: Audit contest
- Severity: medium
- Program: Centrifuge
- Found by: 0xStalin
- Disclosed: 2023-10-11
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2023-09-centrifuge#m-05
- Library page: https://bugbountylibrary.com/r/c4%3A2023-09-centrifuge%3AM-05
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos vuln:precision-loss

**Target:** LiquidityPool/InvestmentManager deposit claim flow
**Root cause:** calculateDepositPrice averages prices across multiple unclaimed requestDeposits executed at different epochs; rounding makes _calculateTrancheTokenAmount slightly exceed the shares actually minted to Escrow for that user, so the claim transfers more shares than owed.
**Steps:**
1. Investor requests deposit in epoch 1; Centrifuge chain executes collectInvest at price 1.25, minting 80e18 shares to Escrow, maxDeposit=100e6, maxMint=80e18.
2. Investor requests another deposit in epoch 2 at price 2, minting 50e18 shares; maxDeposit/maxMint accumulate.
3. Investor calls `lPool.deposit(lPool.maxDeposit(self), self)`; processDeposit computes averaged depositPrice and a rounded _trancheTokenAmount slightly above the shares minted for that user, transferring extra shares from Escrow.
4. Second investor (Alice) with a single epoch-2 deposit calls `lPool.deposit(lPool.maxDeposit(alice), alice)` (or `lPool.mint(lPool.maxMint(alice), alice)`); Escrow lacks enough shares and the call reverts.
**How found:** Noticed that maxDeposit/maxMint accumulate across multiple epochs while calculateDepositPrice averages all unclaimed requests, and reasoned the averaged price times currencyAmount would not exactly equal the sum of shares minted, producing a rounding surplus on claim.
**Exploitation:** Any investor with multiple unclaimed deposits across epochs at differing prices claims via deposit()/mint(); rounding causes Escrow to pay out marginally more tranche tokens than minted for them, leaving Escrow short so subsequent investors' claims revert. No direct fund loss; availability/griefing of other claimants.
**Insight:** When a contract averages historical execution prices to derive a claim amount, compare the derived share count against the per-user minted maxMint; any surplus is silently taken from a shared Escrow pool and starves later claimants.