# Perps - GTL post-only orders skew totalAssets accounting, minting excessive shares and rendering the GTL vault insolvent

GTL vault's first post-only order posts collateral but skips subaccount registration, so totalAssets undercounts and deposits mint inflated shares, insolvency.

- Payout: Contest reward
- Severity: medium
- Program: GTE
- Credited: lodelux
- Disclosed: 2026-02-05
- Write-up quality: 7/10
- Original: https://code4rena.com/reports/2025-08-gte-perps-and-launchpad#m-12
- Library page: https://bugbountylibrary.com/r/c4%3A2025-08-gte-perps-and-launchpad%3AM-12
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:share-inflation

**Target:** ClearingHouse.sol / GTL ERC4626 vault share accounting
**Root cause:** ClearingHouse::placeOrder returns early when baseTraded==0 (post-only), skipping _processTakerFill/updateAccount, so GTL::addSubaccount is never called for the new subaccount even though collateral was posted.
**Steps:**
1. GTL admin places a post-only limit order on a fresh subaccount via ClearingHouse::placeOrder; baseTraded==0 so early return after handleCollateralDelta.
2. Collateral is debited from GTL to orderbook, but subaccount not added to GTL._subaccounts set.
3. GTL::totalAssets() iterates only _subaccounts, omitting the posted orderbook collateral.
4. User calls GTL::deposit; shares = assets/(totalAssets()+1)*(totalSupply()+1) with understated totalAssets, minting excess shares.
5. Later order fills and subaccount registers, restoring totalAssets; inflated depositor drains value from others.
**How found:** Code reading of placeOrder early-return path vs. setAssets/addSubaccount registration only occurring on fills; traced totalAssets iteration over _subaccounts.
**Exploitation:** Attacker monitors GTL for a pending post-only order on a new subaccount, then deposits USDC while totalAssets is understated, receiving inflated shares that redeem against the corrected (higher) NAV.
**Insight:** In vault share accounting, any path that moves assets out of the vault without updating the asset-tracking set creates a transient NAV understatement; check early-return branches in order/fill handlers for skipped accounting hooks.