# Vault `_maxDeposit` incorrect calculation allows to bypass vault deposit cap

Perennial Vault _maxDeposit added claimable redeemed assets to the cap, letting users deposit-redeem-repeat to bypass the vault deposit cap indefinitely.

- Payout: Contest reward
- Severity: medium
- Program: Perennial
- Credited: panprog
- Disclosed: 2023-10-26
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-10-perennial-judging/issues/27
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AM-6
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Perennial Vault.sol _maxDeposit / deposit cap logic
**Root cause:** _maxDeposit computed maxDeposit = claimableAssets + (cap - min(collateral, cap)), always adding context.global.assets (redeemed-but-unclaimed) to the result, so the returned allowance is at least the claimable amount even when collateral is at or above cap.
**Steps:**
1. Set vault cap to 100 via updateParameter.
2. Deposit 100, settle; further 10 deposit reverts (cap reached).
3. Redeem 50, settle; totalAssets drops to 50 while 50 remains claimable.
4. Deposit 100 succeeds (cap check uses claimable+cap-collateral), totalAssets becomes 150.
5. Deposit 50 more succeeds, totalAssets 200; repeat redeem/deposit to grow unbounded.
**How found:** Code review of _maxDeposit formula: noticed context.global.assets (claimable) is added rather than subtracted from collateral, contradicting the intent of capping collateral; confirmed with a Foundry/Hardhat test showing cap bypass.
**Exploitation:** User deposits to cap, redeems a portion without claiming, then deposits again; because _maxDeposit adds unclaimed redeemed assets, each cycle allows depositing up to cap + claimable, growing vault assets past the cap indefinitely.
**Escalation:** Repeat redeem-without-claim then deposit cycles to scale vault deposits arbitrarily beyond the owner's risk cap.
**Insight:** When auditing cap/limit checks, verify the limit formula treats pending/unclaimed balances consistently with how totalAssets counts them; a term added to the allowance instead of subtracted from collateral silently inflates the cap.