# Vaults for assets that can rebase negatively are prone to unexpectedly revert

Superform's cross-chain withdraw strictly requires redeemed amount >= payload amount, so a negative rebase between update and processing makes withdrawals revert permanently.

- Payout: Contest reward
- Severity: medium
- Program: Superform Erc1155a
- Credited: ljmanini
- Disclosed: 2024-02-13
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_superform_erc1155a_dec2023.pdf#3.2.15
- Library page: https://bugbountylibrary.com/r/cantina%3Asuperform_erc1155a_dec2023%3A3.2.15
- Tags: domain:web3 impact:dos kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** ERC4626FormImplementation#_processXChainWithdraw cross-chain withdrawal flow
**Root cause:** The withdraw processor compares vault.redeem() output dstAmount against the txData amount recorded at payload update time with a strict >= check; a negative rebase between the two transactions lowers share value below the recorded amount.
**Steps:**
1. Alice has a cross-chain deposit into an ERC4626 vault whose asset can negatively rebase (e.g. stETH-style).
2. Alice initiates a cross-chain withdrawal using all her shares.
3. Payload is processed by AMBs and a quorum of proofs reaches Superform on the destination chain.
4. UPDATER keeper updates the payload via CoreStateRegistry, writing txData amount = X.
5. Vault asset suffers a 1% negative rebase; shares now worth 99% of prior asset value.
6. PROCESSOR keeper processes payload; `_processXChainWithdraw()` calls `vault.redeem()` returning 99% of X.
7. Check at ERC4626FormImplementation.sol#L367 (`vars.amount > dstAmount`) reverts, blocking withdrawal.
**How found:** Reasoned about the two-transaction gap between payload update (amount snapshot) and processing (actual redeem), and considered assets that can negatively rebase like Pods Finance's stETHvv after a Lido slashing event; traced the strict comparison in _processXChainWithdraw.
**Insight:** When a protocol snapshots an expected amount in one tx and enforces it in a later tx, look for assets whose value can change between the two (rebasing tokens, slashing, negative yield) — strict equality/>= checks become permanent DoS for users.