# All yield generated in the IBT vault can be drained by performing a vault deflation attack using the flash loan functionality of the Principal Token contract

Permissionless flash loan of the PT's entire IBT balance lets an attacker redeem all vault shares, resetting share price to 1 and stealing accrued yield.

- Payout: Audit contest
- Severity: medium
- Program: Spectra
- Found by: Arabadzhiev
- Disclosed: 2024-04-05
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2024-02-spectra#m-02
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-spectra%3AM-02
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** PrincipalToken flashLoan / ERC4626 IBT vault
**Root cause:** maxFlashLoan returns the PT's entire IBT balance, so an attacker can borrow all shares, redeem them to zero out totalAssets/totalSupply, then re-mint at the default 1:1 price, capturing the price difference.
**Steps:**
1. Attacker calls `principalToken.flashLoan(exploiter, ibt, ibt.balanceOf(principalToken), "")` borrowing the full IBT balance
2. In `onFlashLoan`, call `ibt.redeem(amount, address(this), address(this))` to burn all shares for underlying, resetting vault totalAssets/totalSupply to 0
3. Approve underlying to vault and `ibt.mint(amount + fee, address(this))` at the default 1:1 price
4. Approve PT for `amount + fee` and return the callback hash so the loan repays
5. Attacker keeps the difference between redeemed underlying and re-minted cost, equal to accrued yield
**How found:** Observed that maxFlashLoan returns the full IBT balance and that OZ-style ERC4626 `_convertToAssets` falls back to 1:1 when totalAssets and totalSupply are zero, then reasoned that redeeming all shares mid-flash-loan resets the price before re-minting.
**Exploitation:** Single flash loan with no capital: borrow entire IBT balance from PT, redeem all shares for underlying, re-mint shares plus fee at deflated default price, repay loan; profit equals totalIBTSupply*(initialPrice-defaultPrice), draining all vault yield from PT users.
**Insight:** When a contract flash-lends its entire ERC4626 share balance, check whether the vault's share price has a degenerate default (zero supply) state that a full redeem/re-mint cycle can exploit to capture the price delta.