# `StrategyUtils::_executeDynamicTradeExactIn` does not wrap steth

StrategyUtils overwrites buyToken wstETH with stETH, so the wrap-back branch is unreachable and amountBought is misreported, enabling over-crediting.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: 0x52
- Disclosed: 2022-09-15
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-09-notional-judging/issues/99
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-09-notional%3AH-2
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Leveraged vaults Balancer strategy (StrategyUtils.sol)
**Root cause:** When tradeUnwrapped is true and buyToken is WRAPPED_STETH, buyToken is reassigned to stETH, so the later wrap-back block (which checks buyToken == WRAPPED_STETH) never executes and amountBought reflects stETH, not wstETH.
**Steps:**
1. Call `_executeDynamicTradeExactIn` with `params.tradeUnwrapped = true` and `buyToken = address(Deployments.WRAPPED_STETH)`.
2. Observe line 62 reassigns `buyToken = Deployments.WRAPPED_STETH.stETH()`.
3. Trade executes buying stETH; `amountBought` is stETH units.
4. Line 80-90 wrap block is skipped because `buyToken` is now stETH, not WRAPPED_STETH.
5. Returned `amountBought` (stETH) is used downstream as if it were wstETH, mispricing the trade.
**How found:** Code reading of the tradeUnwrapped branch: noticed buyToken is overwritten to stETH before the wrap-back condition that still checks for WRAPPED_STETH, making that branch dead code.
**Exploitation:** Attacker sets tradeUnwrapped with wstETH as buyToken; since wstETH is worth more than stETH, the returned amountBought overstates value received, letting them extract more than actually sold and corrupting vault accounting.
**Insight:** When a function mutates a parameter (buyToken) mid-flow, check every later branch that re-tests the original value — overwritten variables silently disable wrap/unwrap or accounting fixups.