# The guardian may not be able to blacklist a protocol

Vault.blacklistProtocol underflows when a blacklisted protocol's accrued balance exceeds savedTotalUnderlying, blocking the guardian from removing a malicious protocol.

- Payout: Contest reward
- Severity: medium
- Program: Derby
- Credited: Jeiwan
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-derby-judging/issues/320
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-derby%3AM-9
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** Vault.blacklistProtocol in Derby yield optimiser Solidity contracts
**Root cause:** blacklistProtocol subtracts balanceUnderlying(_protocolNum) from savedTotalUnderlying; if the protocol accrued interest since the last rebalance, its current balance exceeds the cached total and the subtraction underflows/reverts.
**Steps:**
1. Vault has allocations to a single protocol; rebalance sets savedTotalUnderlying = sum of deposited funds.
2. Protocol accrues interest so balanceUnderlying(_protocolNum) > savedTotalUnderlying.
3. Guardian calls `blacklistProtocol(_protocolNum)`.
4. Line 481 `savedTotalUnderlying -= balanceProtocol` underflows and reverts.
5. Call keeps reverting until another protocol has allocations or allocations are cleared by gamers.
**How found:** Code reading of blacklistProtocol's accounting: noticed savedTotalUnderlying is a stale cached snapshot from rebalance while balanceUnderlying is live, so interest accrual can make the subtraction underflow.
**Insight:** When a cached aggregate is decremented by a freshly-read live balance, interest or yield accrual between snapshot and use can make the subtraction underflow; check cached-vs-live invariants in admin emergency functions.