# `wfCashERC4626`

wfCashERC4626 mints 1:1 shares for fee-on-transfer deposits but Notional credits only post-fee prime cash, leaving vault insolvent.

- Payout: Contest reward
- Severity: medium
- Program: Notional Update 5
- Credited: eol
- Disclosed: 2023-12-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-notional-update-5-judging/issues/58
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-notional-update-5%3AM-14
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:precision-loss

**Target:** wrapped-fcash ERC4626 vault (wfCashLogic.sol)
**Root cause:** When lending at zero interest, the vault mints fCashAmount shares equal to the full deposit, but Notional's TokenHandler credits prime cash based on the actual post-fee balance received. The transfer fee is never subtracted from minted shares.
**Steps:**
1. Deposit a fee-on-transfer token (e.g. USDT with fee enabled) into wfCashERC4626 where maxFCash < fCashAmount.
2. wfCashLogic calls NotionalV2.depositUnderlyingToken with fCashAmountExternal; TokenHandler records actualTransferExternal = deposit - fee as prime cash.
3. Vault then calls `_mint(receiver, fCashAmount)` crediting full deposit amount in shares.
4. At maturity, redeeming all shares exceeds the vault's prime cash balance; BalanceHandler._finalize reverts with 'No Prime Borrow' for the shortfall.
**How found:** Code review comparing the mint amount in wfCashLogic against Notional's balance-before/after accounting in TokenHandler for fee-on-transfer tokens.
**Exploitation:** Attacker deposits a fee-on-transfer asset to receive more wfCash shares than the vault's prime cash backing; last redeemers bear the deficit equal to accumulated transfer fees.
**Insight:** When a vault mints shares 1:1 against a deposit, check whether the downstream custodian credits balance by actual received amount (balance delta) rather than the nominal deposit — fee-on-transfer or rebasing tokens create a share/asset mismatch.