# Gain From Balancer Vaults Can Be Stolen

Notional Balancer vaults let anyone deposit, trigger permissionless reinvestReward, and exit same block to steal BPT rewards from existing depositors.

- Payout: Contest reward
- Severity: medium
- Program: Notional
- Credited: xiaoming90
- Disclosed: 2022-09-15
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-09-notional-judging/issues/83
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-09-notional%3AM-7
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:business-logic vuln:flash-loan vuln:reward-distribution

**Target:** Balancer leveraged vault strategy (StrategyUtils BPT/strategy-token conversion)
**Root cause:** reinvestReward is permissionless and BPT rewards are distributed pro-rata over current totalStrategyTokenGlobal with no deposit-duration weighting, so a large same-block deposit dilutes existing holders' share of the reinvested BPT.
**Steps:**
1. Flash-loan ~1,000,000 WETH from dydx.
2. Call `VaultAccountAction.enterVault` with `fCash=0` (no borrow) depositing the WETH; vault mints ~1,000,000 strategy tokens via `_convertBPTClaimToStrategyTokens`.
3. Call permissionless `reinvestReward` so vault BPT balance grows (e.g. +1000 BPT).
4. Call `VaultAccountAction.exitVault`; `_convertStrategyTokensToBPTClaim` returns `(strategyTokens * totalBPTHeld) / totalStrategyTokenGlobal` giving attacker ~999 extra BPT.
5. Repay flash loan; all in one transaction.
**How found:** Code review of `_convertBPTClaimToStrategyTokens` and `_convertStrategyTokensToBPTClaim` showed share price depends on instantaneous totalBPTHeld/totalStrategyTokenGlobal, and that reinvestReward is permissionless with no deposit-duration weighting or exit fee, enabling a sandwich.
**Exploitation:** Attacker flash-loans WETH, enters vault without borrowing (avoiding fees since fee only charged in `_borrowIntoVault`), triggers reinvestReward to inflate totalBPTHeld, then exits same block redeeming strategy tokens at the inflated BPT-per-token rate, capturing nearly all rewards owed to the sole prior depositor.
**Insight:** When a vault distributes yield by inflating a shared token balance, check whether the reward-triggering function is permissionless and whether share price is snapshotted; a same-block deposit/exit around the trigger dilutes long-term holders.