# `Vault._amount_per_base_lp_share` should also consider bad debt when `safety_module_lp_total_amount` is not enough

Vault share pricing ignores bad debt exceeding safety module liquidity, letting early base LPs withdraw full value while later LPs are locked out.

- Payout: Contest reward
- Severity: medium
- Program: Unstoppable
- Credited: GimelSec
- Disclosed: 2023-06-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-unstoppable-judging/issues/92
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-unstoppable%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Vyper margin-dex Vault liquidity pool accounting
**Root cause:** _amount_per_base_lp_share computes share price from base_lp_total_amount without subtracting bad debt that exceeds safety_module_lp_total_amount, so share value is overstated.
**Steps:**
1. Set base_lp_total_amount=100, safety_module_lp_total_amount=100, bad_debt=150, total_debt_amount=0; available liquidity=50.
2. Base LP shares total 100, Alice and Bob each hold 50.
3. Alice calls `withdraw_liquidity(token, 50, false)`; `_amount_to_lp_shares` uses unadjusted `_amount_per_base_lp_share`, so she burns 50 shares for 50 tokens.
4. Bob attempts `withdraw_liquidity` but `_available_liquidity` is now 0, reverting on `assert _amount <= self._available_liquidity(_token)`.
5. Bob's shares are stranded while Alice exited at full value.
**How found:** Code review of withdraw_liquidity path: noticed _amount_per_base_lp_share uses raw base_lp_total_amount while _total_liquidity subtracts bad_debt, then constructed a numeric scenario where bad debt exceeds safety module liquidity.
**Exploitation:** An early base LP withdraws before others once bad debt exceeds safety module coverage; the unadjusted share price lets them redeem full token value, draining available liquidity and leaving remaining LPs unable to withdraw.
**Insight:** When a protocol has a first-loss tranche, check that every share-price/pricing function subtracts losses beyond that tranche; compare the pricing function against the global liquidity function for inconsistent debt handling.