# Attackers Can DOS Balancer Vaults By Bypassing The BPT Threshold

Attacker flash-loans ETH to inflate Balancer BPT supply, nudges vault past BPT threshold, triggers permissionless emergency settlement that locks the vault, causing DoS.

- Payout: Contest reward
- Severity: medium
- Program: Notional
- Credited: xiaoming90
- Disclosed: 2022-09-15
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2022-09-notional-judging/issues/66
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-09-notional%3AM-14
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Balancer leveraged vault BPT threshold / emergency settlement
**Root cause:** BPT threshold is computed from current pool totalSupply, which an attacker can inflate within the same transaction by joining the Balancer pool, letting the vault's BPT share exceed the threshold; emergency settlement then locks the vault (totalAssetCash != 0 blocks enterMaturity).
**Steps:**
1. Flash-loan large ETH from dydx (1 wei fee).
2. Join WETH/stETH Balancer pool with part of ETH, inflating total BPT supply (e.g. 100k -> 200k), raising vault BPT threshold.
3. Enter Notional vault with small amount to push vault BPT held just above the new threshold (e.g. 19,900 -> 20,050).
4. Exit Balancer pool entirely, dropping total BPT supply back (e.g. to 100,150) so vault BPT now exceeds threshold (20,050 > 20,030).
5. Call permissionless emergency settlement; vault sells minimal BPT and becomes locked (totalAssetCash > 0).
6. Redeem vault shares, repay flash loan; cost ~1 wei + negligible slippage.
**How found:** Code review of _bptThreshold using live pool totalSupply combined with the permissionless emergency settlement and the enterMaturity require(totalAssetCash==0) lock; recognized that pool supply is manipulable within one tx via flash loan.
**Exploitation:** Single-transaction flash-loan attack: inflate pool supply, cross threshold, deflate supply, trigger permissionless emergency settle, redeem shares. Vault locked afterward, blocking all new deposits and forcing premature exits.
**Insight:** When a share/ratio limit is computed from a manipulable external pool's totalSupply, check whether an attacker can inflate the denominator in the same tx to cross the limit, then deflate it to make the position violate the limit and trigger a permissionless state transition.