# `totalBPTSupply` will be excessively inflated

Notional's Boosted3TokenAuraVault used totalSupply instead of virtualSupply for BPT, inflating the emergency settlement threshold so keepers never trigger settlement.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: thekmj
- Disclosed: 2022-12-20
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-12-notional-judging/issues/11
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-12-notional%3AH-7
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Boosted3TokenAuraVault.getEmergencySettlementBPTAmount / SettlementUtils
**Root cause:** Balancer Phantom BPT mints all supply to the pool itself, so circulating supply is virtualSupply; the vault read IERC20(pool).totalSupply(), inflating totalBPTSupply (~2**111) and thus the emergencyBPTWithdrawThreshold.
**Steps:**
1. Call `Boosted3TokenAuraVault.getEmergencySettlementBPTAmount(maturity)`; it passes `IERC20(pool).totalSupply()` as totalBPTSupply.
2. `_getEmergencySettlementParams` computes `emergencyBPTWithdrawThreshold = totalBPTSupply * maxBalancerPoolShare / VAULT_PERCENT_BASIS`, hugely inflated.
3. Check `vaultState.totalBPTHeld <= emergencyBPTWithdrawThreshold`; always true, so it reverts `InvalidEmergencySettlement`.
4. Off-chain keeper interprets revert as 'no settlement needed' and skips emergency settlement even when the vault exceeds its pool share.
**How found:** Code review of the emergency settlement path; recognized Balancer Boosted Pool Phantom BPT semantics (all supply minted to pool at creation) and noticed totalSupply used where virtualSupply is required.
**Insight:** For Balancer Phantom/Boosted BPT, totalSupply includes pool-held phantom tokens; any threshold or share computation must use virtualSupply or it will be off by orders of magnitude.