# Sending tokens to a Strategy when totalSupply is 0 can permanently make the Vault unavailable

Donating aTokens directly to a BakerFi Strategy makes totalAssets>0 while totalSupply=0, permanently blocking all deposits via InvalidAssetsState.

- Payout: Audit contest
- Severity: medium
- Program: BakerFi
- Credited: klau5
- Disclosed: 2025-02-26
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-bakerfi-invitational#m-04
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AM-04
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** VaultBase / StrategyLeverageAAVEv3 deposit accounting
**Root cause:** _depositInternal requires totalAssets and totalSupply to be both zero or both positive, but totalAssets reads strategy balances that anyone can inflate by transferring aTokens directly, decoupling it from totalSupply.
**Steps:**
1. Attacker supplies 10 wei cbETH to Aave v3, receiving aTokens.
2. Attacker transfers the aTokens directly to the StrategyLeverageAAVEv3 contract address.
3. vault.totalAssets() now returns >0 while totalSupply()==0.
4. Any call to vault.depositNative reverts with InvalidAssetsState because the (elastic==0 && base==0) || (base>0 && elastic>0) check fails.
**How found:** Code review of _depositInternal's Rebase invariant against _totalAssets, which delegates to strategy.totalAssets() reading live token balances; noticed the invariant can be broken by external balance donation.
**Exploitation:** Precondition: vault has zero shares (pre-first-deposit or fully withdrawn). Attacker acquires the strategy's collateral token (aToken) cheaply and transfers it to the Strategy, inflating totalAssets without minting shares. The deposit guard then rejects every deposit, bricking the vault until an admin seeds/cleans it.
**Insight:** When a vault's totalAssets is derived from live token balances of an external strategy, anyone can desync it from totalSupply by donating tokens; check whether deposit/redeem guards assume the two move together.