# Users may encounter losses on assets deposited through StrategySupplyERC4626

StrategySupplyERC4626 returned ERC4626 shares instead of underlying assets in deploy/undeploy/balance, causing vault share miscalculation and permanent lock of ~half deposited funds.

- Payout: Audit contest
- Severity: high
- Program: BakerFi
- Credited: 0xpiken
- Disclosed: 2025-02-26
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2024-12-bakerfi-invitational#h-01
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:share-inflation

**Target:** StrategySupplyERC4626 strategy / BakerFi Vault (Solidity, ERC4626)
**Root cause:** _deploy, _undeploy and _getBalance return ERC4626 vault shares (deposit/withdraw/balanceOf) instead of underlying asset amounts, so the BakerFi Vault computes user shares and totalAssets against the wrong unit.
**Steps:**
1. Deploy ERC4626Mock vault over WETH; deposit 10e18 WETH to get 10e18 shares.
2. Donate 10e18 WETH directly to the mock vault so totalAssets=20e18, totalSupply=10e18 (1 share = 2 assets).
3. Deploy StrategySupplyERC4626 over the mock vault and a BakerFi Vault using it.
4. `vault.enableAccount(owner,true)`; `weth.approve(vault,10e18)`; `vault.deposit(10e18, owner)`.
5. _deploy returns 10e18 shares (not 20e18 assets), so user is minted shares for only 10e18 assets.
6. `vault.maxWithdraw(owner)` returns 5e18; remaining 5e18 WETH is permanently locked.
**How found:** Code review of the Vault's _deploy/_undeploy/_totalAssets contract expectations (must return asset amounts) versus StrategySupplyERC4626 implementations that return _vault.deposit/withdraw/balanceOf share values; confirmed with a mock ERC4626 whose share price was inflated via donation.
**Exploitation:** Any vault using StrategySupplyERC4626 misprices deposits/withdrawals whenever the underlying ERC4626 share price != 1 asset. Depositors receive fewer vault shares than their asset value, and the surplus assets become unclaimable, locked in the vault.
**Insight:** When a strategy wraps an ERC4626, audit the unit of every return value crossing the strategy boundary: deposit/withdraw/balanceOf yield shares, not assets. Donation-inflated share price exposes the mismatch immediately.