# Gain From LMPVault Can Be Stolen

Permissionless updateDebtReporting lets a flash-loan-funded depositor mint shares just before reward accrual and withdraw after, diluting existing holders' gains.

- Payout: Contest reward
- Severity: high
- Program: Tokemak
- Credited: 0x007
- Disclosed: 2023-06-30
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-06-tokemak-judging/issues/620
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-tokemak%3AH-12
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan

**Target:** LMPVault.sol updateDebtReporting / share accounting
**Root cause:** updateDebtReporting is permissionless and share price jumps when queued rewards are recognized, with no deposit/withdrawal fee or duration snapshotting, so a large late depositor captures most of the gain.
**Steps:**
1. Liquidator queues 30 WETH rewards to DVs' MainRewarder contracts.
2. Bob flash-loans 1,000,000 WETH and deposits into LMPVault, minting ~1,000,000 shares at NAV 1.0.
3. Bob calls `LMPVault.updateDebtReporting`, raising total assets by 30 WETH; NAV becomes ~1.00003.
4. Bob withdraws all shares receiving ~1,000,029.997 WETH.
5. Bob repays flash loan (negligible fee) and keeps ~29.997 WETH of Alice's gain.
**How found:** Reviewer reasoned about share price mechanics: recognizing queued rewards inflates NAV per share, and since entry/exit is same-block and fee-free, a large capital injection just before recognition dilutes long-term holders.
**Exploitation:** Single-transaction flash-loan deposit -> permissionless updateDebtReporting to realize queued rewards -> immediate withdrawal, capturing ~99.99% of the 30 WETH gain while existing holders get ~0.003 WETH.
**Escalation:** Can be repeated each time rewards are queued; also executable via mempool front-run/back-run sandwich of the updateDebtReporting tx without a flash loan.
**Insight:** When a permissionless function realizes off-vault yield into share price, check whether deposit/withdraw can be sandwiched around it in one block; flash-loan capital makes dilution attacks nearly free absent fees or duration-weighted snapshots.