# Users can be forced to claim assets at bad rate in some cases

BalancedVault.claim() lets anyone claim for another account, forcing users to realize pro-rata losses before collateral recovers.

- Payout: Contest reward
- Severity: medium
- Program: Perennial
- Credited: mstpr-brainbot
- Disclosed: 2023-05-05
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-05-perennial-judging/issues/174
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-05-perennial%3AM-14
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** BalancedVault.sol claim() function
**Root cause:** claim() has no access control, so any caller can trigger a pro-rata claim for an arbitrary account. Pro-rata reduction applies when total collateral is below total unclaimed, so the victim realizes a loss they would otherwise defer.
**Steps:**
1. Vault is in a state where total collateral < total unclaimed amount (pro-rata active).
2. Victim redeems shares but does not call claim() to avoid realizing the loss.
3. Attacker calls `claim(victim)` on BalancedVault.sol#L211-L228.
4. Victim receives reduced assets; attacker's relative share of recovered collateral increases.
**How found:** Code review of claim() access control combined with understanding of the pro-rata condition (collateral < unclaimed); noted the function lacked a msg.sender==account check.
**Exploitation:** Attacker monitors vaults in pro-rata state and calls claim() on behalf of users who are deferring claims, forcing them to crystallize losses while the attacker retains exposure to recovery.
**Insight:** When a protocol intentionally leaves a state-changing function permissionless for UX (e.g. MultiInvoker), check whether that function can move another user into an unfavorable accounting state — griefing via forced realization of losses is a valid finding even if the underlying pro-rata mechanism is acknowledged.