# updateDebtReporting can be front run, putting all the loss on later withdrawals but taking the profit

LMPVault.updateDebtReporting accepts a user-chosen destination subset, letting an attacker report only profitable vaults, withdraw at inflated share price, and dump losses on remaining LPs.

- Payout: Contest reward
- Severity: high
- Program: Tokemak
- Credited: Kalyan-Singh
- Disclosed: 2023-06-30
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2023-06-tokemak-judging/issues/531
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-tokemak%3AH-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LMPVault.updateDebtReporting (Solidity vault accounting)
**Root cause:** updateDebtReporting takes a caller-supplied _destinations array and only recomputes debt for those vaults, so stale loss-bearing destinations are excluded from the NAV used for share pricing.
**Steps:**
1. Deploy scenario: LMPVault holds 1000 in DestVault1 and 1000 in DestVault2, no idle.
2. Set DestVault2 price to 0.9 (10% loss) and DestVault1 price to 2.1 (5% gain); net vault loss = 50.
3. Attacker calls `_lmpVault.updateDebtReporting([address(_destVaultOne)])` excluding the losing vault.
4. Attacker calls `_lmpVault.redeem(shareBalAlice, alice, alice)` in same flow, receiving ~1019 assets (profit +19).
5. Later legit `updateDebtReporting(_destinations)` for all vaults forces remaining LPs to absorb ~80 loss.
**How found:** Reviewer noticed updateDebtReporting's _destinations is fully user-controlled and that NAV/share price derives from reported debt, so omitting a loss-bearing vault inflates share value; confirmed with a Foundry PoC.
**Exploitation:** Attacker front-runs a pending updateDebtReporting tx with a call passing only profitable destinations, then redeems shares at the inflated NAV before the honest update lands, extracting profit and leaving the loss to remaining LPs and fee sink.
**Insight:** When a reporting/settlement function accepts a caller-chosen subset of accounts, check whether share/NAV pricing depends on that subset — omitting loss-bearing entries lets the caller exit at a stale favorable price.