# Vault's savedTotalUnderlying tracks withdrawn funds incorrectly

Derby Vault's pullFunds decrements savedTotalUnderlying by the requested amount, not the amount actually withdrawn, understating vault balance and skewing rebalance allocations.

- Payout: Contest reward
- Severity: high
- Program: Derby
- Credited: Ch_301
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-derby-judging/issues/363
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-derby%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Vault.sol pullFunds/withdrawFromProtocol accounting
**Root cause:** pullFunds subtracts amountToWithdraw from savedTotalUnderlying before withdrawFromProtocol, but actual received amount differs due to share caps, provider liquidity, and swap slippage; also subtracts minimumPull when no withdrawal occurs.
**Steps:**
1. Call rebalance() so reservedFunds > vaultCurrency.balanceOf(vault) triggers pullFunds(reservedFunds).
2. pullFunds computes amountToWithdraw and executes `savedTotalUnderlying -= amountToWithdraw` before withdrawFromProtocol.
3. withdrawFromProtocol caps shares by provider balance and swaps via Curve, returning amountReceived != amountToWithdraw.
4. If amountToWithdraw < minimumPull, loop breaks after already decrementing savedTotalUnderlying.
5. Understated savedTotalUnderlying feeds calcUnderlyingIncBalance, reducing computed allocations in subsequent rebalances.
**How found:** Code review of pullFunds ordering: noticed savedTotalUnderlying decremented before the actual withdraw call, and that withdrawFromProtocol's return value is discarded despite share caps and swap slippage making received amount non-deterministic.
**Insight:** When auditing accounting state updates, check whether the variable is decremented by the requested amount versus the actual realized return of the withdrawal/swap function; functions that cap shares or swap via AMM are prime sources of divergence.