# Improper accounting of totaldeposited resulting in corrupted pool state in rewardsmanager

OmniPool withdraw deducts post-fee amount from totalDeposited, leaving fees counted; corrupts RewardsManager reward math and risks protocol insolvency.

- Payout: Contest reward
- Severity: high
- Program: Opal
- Credited: Sujith Somraaj
- Disclosed: 2024-03-30
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_opal_feb2024.pdf#3.2.17
- Library page: https://bugbountylibrary.com/r/cantina%3Aopal_feb2024%3A3.2.17
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:cantina sev:high technique:source-review vuln:accounting-error vuln:business-logic

**Target:** OmniPool withdraw / RewardsManager reward accounting
**Root cause:** In withdraw(), totalDeposited is decremented by underlyingWithdrawn_ after fees are subtracted, so protocol fees remain counted as deposited.
**Steps:**
1. Call `_testDeposit(pools[0])` then `_testWithdraw(pools[0])`
2. Read `Omnipool(pools[0]).getTotalDeposited()`
3. Observe 91554556 instead of expected 41763373; fees 49791183 not deducted
**How found:** Code review of withdraw() accounting order: noticed totalDeposited decrement placed after fee subtraction, then confirmed via deposit/withdraw PoC comparing logged totals.
**Escalation:** Corrupted totalDeposited feeds _updateOmnipoolState() in RewardsManager, inflating reward calculations toward protocol insolvency.
**Insight:** When a fee is carved out of a withdrawal, check whether aggregate accounting variables are decremented before or after the fee split; downstream reward contracts often trust these totals.