# Vault checkpoints slightly incorrect conversion from assets to shares leads to slow loss of funds for long-time vault depositors

Perennial Vault checkpoint toSharesGlobal applies settlement and trade fees multiplicatively instead of additively, inflating each depositor's shares by settlementFee*tradeFeePct and slowly diluting long-term depositors.

- Payout: Contest reward
- Severity: medium
- Program: Perennial V2 3
- Credited: panprog
- Disclosed: 2024-02-28
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-02-perennial-v2-3-judging/issues/25
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-perennial-v2-3%3AM-9
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:precision-loss

**Target:** Perennial Vault Checkpoint.sol (toSharesGlobal/_withSpread)
**Root cause:** toSharesGlobal subtracts settlementFee before applying the tradeFee spread, so fees compound multiplicatively ((1-s)*(1-t)) instead of being summed (1-s-t), over-crediting shares by settlementFee*tradeFeePct per deposit.
**Steps:**
1. Set linear/trade fee = 2%, settlement fee = $1.
2. User1 deposits $100: vault assets = $97, shares = 100.
3. User2 deposits $100: shares = ($100-$1)*100/$97*($100-$2)/$100 = 100.02.
4. User2 receives 0.02 extra shares, diluting User1's share value.
5. Repeat deposits/redeems to accumulate loss for long-term depositors.
**How found:** Code review of Checkpoint.toSharesGlobal: noticed settlementFee subtracted before _withSpread applies tradeFee, then algebraically compared the composed formula against the market's actual collateral accounting (deposit - settlementFee - tradeFee) to derive the error term settlementFee*tradeFeePct.
**Exploitation:** Any depositor repeatedly depositing into the vault receives slightly inflated shares (settlementFee*tradeFeePct extra per deposit), steadily diluting existing holders; no capital or special access needed, just normal deposit flow.
**Insight:** When a share/asset conversion applies multiple fees in sequence, verify the order matches the protocol's actual collateral math; chained multiplicative fee application vs additive subtraction leaks a settlementFee*tradeFeePct error per deposit that compounds across many transactions.