# Vault4626: donation inflates totalAssets, redeem drains WETH

Vault4626's totalAssets() counted donated non-asset WETH as asset value, letting an attacker inflate share price and redeem for both USDC and WETH.

- Payout: Real-world hack
- Severity: high
- Program: Vault4626
- Credited: DeFiHackLabs
- Disclosed: 2026-06-29
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/Vault4626_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260629-vault4626
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:oracle-manipulation

**Target:** ERC4626 vault proxy on Base
**Root cause:** totalAssets() quotes idle non-asset WETH into asset value, while redeem() transfers the non-asset WETH itself to the redeemer, double-counting the donation.
**Steps:**
1. Flash loan 1,755,018.731120 USDC from Morpho.
2. Flash loan 12.92 WETH from Balancer.
3. Deposit the USDC into Vault4626 to receive shares.
4. Transfer (donate) the 12.92 WETH directly to the vault, inflating totalAssets().
5. Redeem all shares; vault pays USDC value plus the donated WETH.
6. Swap surplus USDC to WETH on Uniswap V3 (0.3% pool).
7. Repay Balancer WETH flash loan and Morpho USDC flash loan; keep ~13.53 WETH profit.
**How found:** Likely identified that totalAssets() included non-asset token balances (WETH) while redeem() paid out that same token, creating a double-counting opportunity via donation.
**Exploitation:** Attacker used nested flash loans (Morpho USDC, Balancer WETH) to deposit USDC for shares, donate WETH to inflate totalAssets(), then redeem shares to receive both the USDC value and the WETH, converting surplus USDC to WETH for profit.
**Insight:** In ERC4626 vaults, check whether totalAssets() includes tokens that are not the vault's underlying asset; if so, a donation of that token can inflate share price and be redeemed for profit.