# Incorrect approach to tracking the PnL of a DV

Tokemak LMPDebt resets debtBasis on any rebalance, so a DV still at a loss is treated as break-even, letting users burn all shares and lock losses on vault shareholders.

- Payout: Contest reward
- Severity: high
- Program: Tokemak
- Credited: xiaoming90
- Disclosed: 2023-06-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-tokemak-judging/issues/589
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-tokemak%3AH-8
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LMPVault / LMPDebt.sol withdrawal accounting
**Root cause:** Loss detection compares currentDvDebtValue against updatedDebtBasis, but any rebalancing overwrites debtBasis to the current (already-reduced) value, erasing the recorded loss.
**Steps:**
1. DV_A at T0: currentDvDebtValue=95 WETH, updatedDebtBasis=100 WETH -> loss detected, share burn limited.
2. At T1 a slight rebalance deposits a few LP tokens, currentDvDebtValue rises to 98 WETH.
3. Rebalance updates destInfo.debtBasis and destInfo.ownedShares to current values.
4. Now currentDvDebtValue == updatedDebtBasis, so `if (currentDvDebtValue < updatedDebtBasis)` at LMPDebt.sol#L275 is false.
5. User withdraws and burns all DV_A shares, locking the remaining 5 WETH loss on vault shareholders.
**How found:** Code-reading of the PnL tracking in LMPDebt.sol: noticed loss detection relies on updatedDebtBasis, which is overwritten on every rebalance, so a loss is written off whenever debtBasis is refreshed.
**Exploitation:** A user waits for/triggers a minor rebalance on a loss-making DV, then withdraws, burning all DV shares since the loss check no longer triggers, socializing the loss onto remaining vault shareholders.
**Insight:** When auditing loss/PnL gating, check whether the 'basis' used for comparison is ever reset by routine operations (rebalance, deposit) — a reset silently clears the loss flag and disables the protective share-burn limit.