# Destination Vault rewards are not added to idleIncrease when info.totalAssetsPulled > info.totalAssetsToPull

In Tokemak LMPVault._withdraw, when pulled assets exceed target, idleIncrease is overwritten instead of incremented, so Destination Vault rewards are unrecorded and frozen.

- Payout: Contest reward
- Severity: high
- Program: Tokemak
- Credited: 0x73696d616f
- Disclosed: 2023-06-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-tokemak-judging/issues/5
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-tokemak%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** LMPVault._withdraw in Tokemak v2-core
**Root cause:** When totalAssetsPulled exceeds totalAssetsToPull, idleIncrease is assigned (=) rather than incremented (+=), discarding the Destination Vault reward amount previously added.
**Steps:**
1. Call withdraw on LMPVault such that a Destination Vault returns more base asset than expected (reward included).
2. In _withdraw, idleIncrease += balanceOf - assetPreBal - assetPulled records the reward.
3. totalAssetsPulled += assetPulled exceeds totalAssetsToPull, triggering the branch.
4. Branch sets idleIncrease = totalAssetsPulled - totalAssetsToPull, overwriting the reward accounting.
5. Reward base asset remains in contract but unrecorded; recover cannot extract baseAsset, so it is frozen.
**How found:** Code reading of the _withdraw branch: noticed the assignment vs increment mismatch and traced that assetPulled excludes Destination Vault rewards, so the overwrite drops them.
**Insight:** When a loop accumulates a value then has an early-exit 'cap' branch, check whether the cap branch uses = instead of +=; overwriting discards prior accumulation like reward deltas.