# Unexpected behavior when calling certain ERC4626 functions

wfCash ERC4626 totalAssets returns zero between fCash maturity and global settlement, breaking convertToAssets/convertToShares and reverting previewWithdraw.

- Payout: Contest reward
- Severity: medium
- Program: Notional Update 5
- Credited: CL001
- Disclosed: 2023-12-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-notional-update-5-judging/issues/43
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-notional-update-5%3AM-8
- Tags: domain:web3 impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** wrapped-fcash ERC4626 wrapper (wfCashBase/wfCashERC4626)
**Root cause:** _getMaturedCashValue returns 0 when pr.supplyFactor==0, assuming settlement already ran; but settlement is lazy (triggered by first account settle), so post-maturity pre-settlement totalAssets is 0.
**Steps:**
1. Deploy/observe wfCash wrapper with fCash that has matured but no account has settled.
2. Call `NotionalV2.getSettlementRate(currencyId, maturity)` — supplyFactor is 0.
3. Call `totalAssets()` — `_getMaturedCashValue(totalSupply())` returns 0, so totalAssets returns 0.
4. Call `convertToAssets(x)` / `previewRedeem` / `maxWithdraw` — all return 0.
5. Call `convertToShares(x)` / `previewWithdraw` — division by zero, revert.
**How found:** Code reading of _getMaturedCashValue comment at wfCashBase.sol:215 assuming supplyFactor==0 implies settled; recognized settlement is lazy and only triggered by first account settle, leaving a window where totalAssets is zero.
**Exploitation:** No direct exploit described; an integrating protocol using convertToAssets as valuation/collateral would read 0 during the window, potentially allowing attackers to manipulate mint/withdraw amounts or collateral checks.
**Insight:** When a contract assumes a lazy global-settlement flag is already set, check who triggers settlement and whether a maturity-to-first-settle window leaves dependent view functions returning zero or reverting.