# BalancedVault.sol: claim can be impossible due to unsigned integer underflow

BalancedVault.claim reverts on unsigned underflow when _totalAssetsAtEpoch is 0 after liquidation, blocking users from claiming pro-rata assets.

- Payout: Contest reward
- Severity: medium
- Program: Perennial
- Credited: roguereddwarf
- Disclosed: 2023-05-05
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-05-perennial-judging/issues/57
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-05-perennial%3AM-7
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos vuln:liquidation

**Target:** BalancedVault.sol claim/_rebalancePosition
**Root cause:** _rebalancePosition computes `_totalAssetsAtEpoch(context) - claimAmount`; after liquidation _totalAssetsAtEpoch is 0 while claimAmount is nonzero, causing unsigned underflow revert.
**Steps:**
1. Deposit into vault as two users, sync.
2. Redeem most shares but leave unclaimed.
3. Oracle update makes long position liquidatable; settle accounts, closeTake, liquidate vault.
4. Settle and rebalance vault back to normal price.
5. Call `vault.claim(user2.address)` -> reverts due to `0 - claimAmount` underflow in _rebalancePosition.
**How found:** Code reading of claim -> _rebalancePosition arithmetic; noticed _totalAssetsAtEpoch can be 0 post-liquidation while claimAmount is nonzero, then reproduced with a modified insolvency test.
**Exploitation:** No attacker; a legitimate user's claim reverts after a liquidation leaves _totalAssetsAtEpoch at 0, locking their entitled pro-rata assets until someone donates funds to the vault.
**Insight:** In vault accounting, check subtraction operands where one side derives from epoch state that can be zeroed by liquidation; pro-rata claim paths are prime spots for underflow DoS.