# Depositor can bypass the max deposit limit

Vault deposit limit checked against msg.sender's shares, not the receiver, so depositing to a fresh address bypasses the per-wallet max.

- Payout: Audit contest
- Severity: medium
- Program: BakerFi
- Credited: 0xlemon
- Disclosed: 2025-02-26
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-bakerfi-invitational#m-07
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AM-07
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** VaultBase.sol deposit logic (Solidity vault contract)
**Root cause:** _depositInternal computes existing deposit from balanceOf(msg.sender) shares but mints shares to the receiver, so a depositor using a fresh receiver always has zero prior balance counted.
**Steps:**
1. Bob has zero shares in vault: `balanceOf(Bob) == 0`.
2. Bob creates a second wallet to receive minted shares.
3. Bob calls `Vault::deposit(assets, receiver=secondWallet)`.
4. Check computes `depositInAssets = balanceOf(msg.sender)*_ONE/tokenPerAsset()` = 0, so `newBalance = assets` never exceeds maxDeposit.
5. Shares minted to second wallet; Bob's balanceOf stays 0.
6. Repeat indefinitely to exceed maxDepositLocal.
**How found:** Code reading of _depositInternal: noticed the limit check uses balanceOf(msg.sender) while shares are minted to the receiver parameter, a mismatch between the address checked and the address credited.
**Exploitation:** Depositor repeatedly calls deposit() with a fresh receiver address each time; since the limit check reads msg.sender's share balance (always 0), the per-wallet cap is never enforced, allowing unlimited deposits into the vault.
**Insight:** When a per-account cap is enforced, verify the accounting key (msg.sender vs receiver vs owner) matches the address that actually accrues the tracked balance; any receiver/beneficiary parameter that differs from the checked address is a bypass vector.