# Malicious users could lock in the NAV/Share of the DV to cause the loss of fees

Permissionless updateDebtReporting locks a temporarily spiked NAV/share high-water mark in LMPVault, suppressing performance fee collection until NAV exceeds the spike.

- Payout: Contest reward
- Severity: medium
- Program: Tokemak
- Credited: 0x73696d616f
- Disclosed: 2023-06-30
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-tokemak-judging/issues/601
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-tokemak%3AM-8
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:fee-bypass vuln:oracle-manipulation

**Target:** LMPVault fee accounting (_collectFees / updateDebtReporting)
**Root cause:** navPerShareHighMark is set to the current NAV/share whenever it exceeds the previous mark, with no decay; a transient price spike permanently raises the threshold.
**Steps:**
1. LMPVault has few shares (e.g. 0.5) and navPerShareHighMark=1 (1:1).
2. A DV LP token price spikes temporarily, raising LMPVault debt and currentNavPerShare to ~1.4.
3. Call permissionless `updateDebtReporting()`; `_collectFees` computes profit=(1.4-1)*totalSupply, fees=profit*performanceFeeBps/MAX_FEE_BPS^2 (~0.02 ETH), mints fee shares, then sets `navPerShareHighMark = 1.4`.
4. Price reverts; currentNavPerShare falls to ~1.05, below the locked 1.4 mark, so no fees accrue until NAV exceeds 1.4 again.
**How found:** Code review of `_collectFees`: noticed the high-water mark is unconditionally overwritten on any upward move and that updateDebtReporting is permissionless, then reasoned about a temporary price spike with low share supply.
**Exploitation:** Attacker (or any caller) times a call to the permissionless updateDebtReporting during a transient NAV spike, locking the high-water mark at the peak so subsequent real growth yields no performance fees to the protocol.
**Insight:** When auditing fee/high-water-mark accounting, check whether the mark can be ratcheted by a transient, manipulable NAV spike via a permissionless trigger, and whether any decay or time-weighting exists.