# Redeeming all UXD tokens is not possible if some have been minted via Perp quote minting

PerpDepository's netAssetDeposits only tracks assetToken deposits, so quoteToken (USDC) minting inflates UXD supply beyond redeemable collateral, blocking last redeemers.

- Payout: Contest reward
- Severity: medium
- Program: Uxd
- Credited: berndartmueller
- Disclosed: 2022-12-27
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-uxd-judging/issues/338
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-uxd%3AM-8
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** PerpDepository.sol redeem/deposit accounting
**Root cause:** _depositAsset increments netAssetDeposits but quote-token minting (negative PnL payoff) does not, so UXD supply can exceed netAssetDeposits; _withdrawAsset caps redemptions at netAssetDeposits.
**Steps:**
1. Alice deposits 10 WETH -> netAssetDeposits=10, supply=10_000e18
2. Bob deposits 10 WETH -> netAssetDeposits=20, supply=20_000e18
3. Caroline deposits 1_000e6 USDC via quote minting (negative PnL) -> netAssetDeposits stays 20, supply=21_000e18
4. Caroline redeems 1_000e18 UXD for 1 WETH -> netAssetDeposits=19, supply=20_000e18
5. Bob redeems 10_000e18 UXD for 10 WETH -> netAssetDeposits=9, supply=10_000e18
6. Alice redeems 10_000e18 UXD for 10 WETH -> reverts InsufficientAssetDeposits(9 ether, 10 ether)
**How found:** Code reading of PerpDepository deposit/withdraw accounting: noticed _depositAsset updates netAssetDeposits but quote-token deposit path does not, then constructed a multi-user timeline to show supply exceeding redeemable collateral.
**Exploitation:** No attacker profit; griefing/DoS where last redeemers cannot withdraw because quote-minted UXD is unbacked by netAssetDeposits and quote redeem is disabled.
**Insight:** When a protocol tracks collateral via a single accounting variable, enumerate every mint/deposit path (asset vs quote, rebalance, PnL settlement) and check each updates that variable; asymmetric updates create unbacked supply and last-redeemer DoS.