# Lyra vault underestimates the collateral value

Isomorph's Lyra vault always subtracts the LP withdrawal fee when pricing collateral, but Lyra only charges it when live option boards exist, undervaluing collateral and enabling premature liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Isomorph
- Credited: hansfriese
- Disclosed: 2022-11-05
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-11-isomorph-judging/issues/242
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-11-isomorph%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:liquidation vuln:oracle-manipulation

**Target:** Vault_Lyra.sol priceCollateralToUSD collateral pricing
**Root cause:** priceCollateralToUSD always applies the Lyra liquidity pool withdrawal fee, but Lyra's _getTotalBurnableTokens only applies the fee when optionMarket.getNumLiveBoards() != 0, so collateral is priced below its real redeemable value when no live boards exist.
**Steps:**
1. Read `Vault_Lyra.sol#L77` `priceCollateralToUSD()`: computes `USDValue = _amount * tokenPrice / LOAN_SCALE` then `USDValueAfterFee = USDValue * (LOAN_SCALE - withdrawalFee) / LOAN_SCALE`.
2. Compare with Lyra `LiquidityPool._getTotalBurnableTokens()`: `tokenPriceWithFee = tokenPrice * (UNIT - withdrawalFee)` only if `optionMarket.getNumLiveBoards() != 0`, else `tokenPriceWithFee = tokenPrice`.
3. Observe Isomorph applies the fee unconditionally, so when the option market has zero live boards the vault reports collateral value lower than the actual withdrawal value.
4. Result: borrower appears closer to liquidation threshold than reality; liquidator repays debt, seizes undervalued collateral, and redeems from Lyra pool without paying the fee.
**How found:** Code-reading comparison: the auditor cross-checked Isomorph's collateral pricing against the actual Lyra LiquidityPool withdrawal implementation and noticed the fee is conditional on live option boards in Lyra but unconditional in Isomorph.
**Exploitation:** Liquidator monitors borrowers whose Lyra collateral has no live option boards; because the vault under-prices that collateral, the position crosses the liquidation threshold early. Liquidator repays the debt, receives the collateral at the discounted valuation, then withdraws it from the Lyra pool where no withdrawal fee is actually charged, capturing the fee difference as profit.
**Insight:** When a protocol prices an external LP/LST position, diff its valuation formula against the source protocol's actual redemption path line by line; conditional fees (e.g. only charged when live boards exist) are a common source of systematic under/over-valuation that liquidators can farm.