# _account_for_withdraw_liquidity rounding in the wrong direction will run out of the vault

Vault._amount_to_lp_shares rounds down when computing shares to burn on withdrawal, letting users burn fewer shares than owed and slowly draining the vault.

- Payout: Contest reward
- Severity: medium
- Program: Unstoppable
- Credited: kutugu
- Disclosed: 2023-06-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-unstoppable-judging/issues/37
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** Vyper margin-dex Vault contract, _account_for_withdraw_liquidity / _amount_to_lp_shares
**Root cause:** _amount_to_lp_shares computes shares to subtract on withdrawal with integer division that rounds down, so the user's share balance is reduced by less than the true value; the discrepancy accumulates across interactions.
**Steps:**
1. User calls withdraw liquidity on base_lp or safety_module path, invoking `_account_for_withdraw_liquidity(_token, _amount, _is_safety_module)`.
2. `_amount_to_lp_shares` computes `new_shares = _amount * PRECISION * PRECISION / wei_per_share`, truncating (rounding down).
3. Contract subtracts the truncated `shares` from `base_lp_shares[_token][msg.sender]` and `base_lp_total_shares[_token]` while removing the full `_amount` of underlying.
4. Repeat withdrawals; each leaves residual shares, so the user extracts more underlying than their shares justify.
5. Over time total shares exceed backing, draining the vault and leaving it unable to repay all liquidity.
**How found:** Reviewer applied the standard ERC4626-style rounding-direction rule: shares burned on withdrawal must round up (favor the vault), spotted that `_amount_to_lp_shares` truncates down, and reasoned the error accumulates across users.
**Exploitation:** Any LP repeatedly withdraws small amounts; truncation on each withdrawal leaves dust shares credited to the user while full underlying is paid out, accumulating value extraction until the vault is insolvent.
**Insight:** In share-based vaults, audit every division in share/asset conversions against the round-in-favor-of-vault rule; withdrawal share-burn paths that truncate down leak dust per call that compounds into insolvency.