# The calculation of assetsMax is incorrect.

StrategySupplyMorpho._undeploy computes assetsMax from stale totalSupplyAssets, ignoring accrued interest, so a redeemer can drain all Morpho shares and strand other vault depositors.

- Payout: Audit contest
- Severity: medium
- Program: BakerFi
- Credited: shaflow2
- Disclosed: 2025-02-26
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-bakerfi-invitational#m-11
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** StrategySupplyMorpho._undeploy (Morpho supply strategy)
**Root cause:** assetsMax is derived from _morpho.totalSupplyAssets/totalSupplyShares snapshots that exclude interest accrued since last update, while the withdraw amount from the vault includes that interest, so assetsMax is underestimated.
**Steps:**
1. Deploy vault with StrategySupplyMorpho; user1 deposits 1e16, user2 deposits 1e20.
2. Let Morpho interest accrue so vault totalAssets() = 1e20+1e16+1e17.
3. user2 redeems all shares; withdrawAmount includes accrued interest.
4. In _undeploy, `assetsMax = shares.toAssetsDown(totalSupplyAssets, totalSupplyShares)` uses stale totals, so assetsMax < amount.
5. Branch `amount >= assetsMax` is false, so `_morpho.withdraw(_marketParams, amount, 0, ...)` executes, converting all strategy shares to assets for user2.
6. Strategy holds 0 Morpho shares; user1's vault shares become unclaimable.
**How found:** Noticed _getBalance uses _morpho.expectedSupplyAssets (interest-aware) while _undeploy uses raw totalSupplyAssets/totalSupplyShares, then traced the branch mismatch against the vault's interest-inclusive withdraw amount.
**Exploitation:** Any vault shareholder redeems after interest accrual; the stale assetsMax forces the partial-withdraw branch which withdraws the full share balance, transferring all strategy assets to the redeemer and leaving remaining shareholders with worthless vault shares.
**Insight:** When a strategy has two balance paths, compare the interest-aware view (expectedSupplyAssets) against raw storage reads used in branch conditions; any divergence between the amount computed upstream and the cap computed locally can flip a partial-withdraw branch into a full drain.