# The maximum size of an `ICHI` vault spell position can be arbitrarily surpassed

IchiVaultSpell's max position size check reads only the spell's own LP token balance, so repeated deposits via openPosition bypass the cap and accumulate oversized positions.

- Payout: Contest reward
- Severity: medium
- Program: Blueberry
- Credited: berndartmueller
- Disclosed: 2023-02-01
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-blueberry-judging/issues/327
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-blueberry%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** IchiVaultSpell.depositInternal position-size validation
**Root cause:** curPosSize is computed from vault.balanceOf(address(this)) on the spell contract, but LP tokens from prior deposits are held by BlueBerryBank, so only the current deposit is counted.
**Steps:**
1. Approve bank to spend ICHI tokens
2. Call bank.execute(0, spell, openPosition(0, ICHI, USDC, depositAmount*4, borrowAmount*6)) to open a position near the cap
3. Call bank.execute again with openPosition(0, ICHI, USDC, depositAmount, borrowAmount*2) to add more
4. Observe no EXCEED_MAX_POS_SIZE revert even though total position exceeds strategy.maxPositionSize
**How found:** Code reading of depositInternal: noticed curPosSize uses vault.balanceOf(address(this)) rather than the bank's tracked position value, and reasoned that LP tokens from earlier deposits sit in BlueBerryBank, not the spell.
**Exploitation:** Attacker repeatedly calls openPosition on the same strategy; each call's curPosSize only reflects the newly minted LP tokens held by the spell, letting the aggregate position grow past maxPositionSize, undermining liquidation margins and risking bad debt.
**Insight:** When a cap check reads a token balance of the spell/helper contract, verify where minted receipt tokens actually custody after execution — the bank/manager often holds them, making the balance a per-call delta rather than cumulative position.