# fulfillRedeem may corrupt share price and allow over-redemption of assets

fulfillRedeem lets vault balance fall below reserved assets, clamping normalizedAssets to zero and inflating share price, so later redeemers over-redeem.

- Payout: Contest reward
- Severity: medium
- Program: SukukFi
- Credited: Audittens
- Disclosed: 2026-04-14
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-11-sukukfi#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2025-11-sukukfi%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ShareTokenUpgradeable / ERC7575VaultUpgradeable share-price accounting
**Root cause:** normalizedAssets uses max(0, balance - pendingDeposit - claimableRedeem - cancelDeposit), so when the vault balance is below reserved assets the negative term clamps to 0 while circulatingSupply is still reduced, inflating share price.
**Steps:**
1. Alice and Bob each deposit 1000 assets; manager invests all 2000.
2. Both request redeem of all shares.
3. Manager fulfills Alice's redeem: balanceOf(vault)=0, claimableRedeemAssets=1000, investmentAssets=2000.
4. normalizedAssets = max(0, 0-1000)+2000 = 2000; circulatingSupply = 2000-1000 = 1000; sharePrice = 2 instead of 1.
5. Manager fulfills Bob's redeem at inflated price; Bob receives more assets than entitled.
6. Manager withdraws investment; Bob completes redeem and drains excess assets, leaving later redeemers unpaid.
**How found:** Code review of share-price formula: noticed max(0, ...) clamp on a term that can go negative when vault balance < reserved assets, while circulatingSupply subtraction remains, producing inconsistent ratio.
**Exploitation:** Investment manager fulfills a redeem while vault balance is insufficient to cover reserved assets, inflating share price; subsequent redeemers redeem at the inflated price and extract more assets than owed, exhausting the pool.
**Insight:** When a price/ratio formula clamps a negative intermediate to zero, check whether the denominator is adjusted consistently; mismatched clamping between numerator and denominator creates arbitrageable mispricing.