# Current period profit can be extracted from the Vault by front running state change before exchange rate recalculation

Derby MainVault uses stale exchangeRate for deposits until rebalance, letting attackers deposit before profit realization and withdraw after to dilute depositor gains.

- Payout: Contest reward
- Severity: medium
- Program: Derby
- Credited: Bobface
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-derby-judging/issues/369
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-derby%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:recon vuln:business-logic vuln:oracle-manipulation

**Target:** MainVault deposit/withdraw exchangeRate
**Root cause:** exchangeRate is only recalculated during rebalancing; deposits and withdrawals between rebalances use the outdated rate, so realized-but-unaccounted profit is not reflected in share pricing.
**Steps:**
1. Monitor estimated P&L of the vault's underlying pools (all public) to predict next exchangeRate
2. When cumulative realized profit exceeds gas/threshold, call `deposit(_amount, _receiver)` while `State.Idle` using stale exchangeRate
3. Wait for rebalance where `setXChainAllocation`/`setXChainAllocationGuard` pushes the higher exchangeRate
4. Call `withdraw(_amount, _receiver, _owner)` immediately after rebalance to capture the profit at depositors' expense
**How found:** Reviewer noticed exchangeRate is only updated in setXChainAllocationInt during rebalancing while deposit/withdraw read the stored value, and that pool P&L is publicly observable, making the next rate predictable.
**Exploitation:** Attacker front-runs the rebalance state change (or deposits on observing accumulated profit), mints shares at the outdated lower exchangeRate, then withdraws after the new higher rate is pushed, extracting the period's realized profit risk-free.
**Insight:** In vault/share-accounting designs, check whether share price is updated lazily at periodic settlement; if underlying P&L is publicly observable, deposits before settlement are a risk-free arbitrage against existing LPs.