# Losses are not distributed equally

Tokemak LMPVault burns profitable DV shares first on withdrawal, letting fast users exit loss-free while slower users absorb concentrated losses.

- Payout: Contest reward
- Severity: medium
- Program: Tokemak
- Credited: xiaoming90
- Disclosed: 2023-06-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-tokemak-judging/issues/591
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-tokemak%3AM-7
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** LMPVault withdrawal queue / destination vault share burning
**Root cause:** Withdrawals burn shares from profitable destination vaults first and only touch loss-making DVs when needed, so exiting users avoid realizing losses that remain concentrated on remaining holders.
**Steps:**
1. Set up DVs A (profit +5%/T), B (-5%/T), C (-10%/T) with equal debt in withdrawal queue order A,B,C.
2. Observe B and C depreciating while A appreciates.
3. Call withdraw; contract burns DV_A shares first to satisfy amount, stopping before B/C.
4. Remaining users now hold only depreciating B/C, accelerating their loss rate (~6%).
**How found:** Reasoned about withdrawal queue ordering and share-burn logic in LMPVault.sol, modeling per-DV appreciation/depreciation to show asymmetric loss allocation.
**Exploitation:** Faster users monitor DV performance, detect depreciating vaults, and front-run others by withdrawing while profitable DV_A shares still cover redemptions, exiting with minimal loss and shifting losses to slower holders.
**Insight:** In multi-vault aggregators, check whether withdrawal share-burn order follows a fixed queue rather than pro-rata across all vaults; profitable-first burning creates a bank-run incentive where informed users exit before losses concentrate.