# Singularity::removeAsset share can become zero due to rounding down, and any user can be extracted some amount of asset

Singularity.removeAsset computes share via rounding-down; when share==0 the allowance check passes, letting anyone withdraw small amounts from any user.

- Payout: Contest reward
- Severity: medium
- Program: Tapioca
- Credited: cergyk
- Disclosed: 2024-02-14
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-02-tapioca-judging/issues/39
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:accounting-error vuln:business-logic vuln:precision-loss

**Target:** Singularity market removeAsset / SGLCommon share conversion
**Root cause:** removeAsset checks allowance against a share amount computed with rounding down; if share rounds to 0 the allowance check trivially passes, so no approval is required.
**Steps:**
1. Victim deposits bUsdo into YieldBox and calls `singularity.addAsset(alice, alice, false, shares)` to supply.
2. Attacker (or any user) calls `singularity.removeAsset(alice, bob, EXTRACT_AMOUNT)` with a tiny amount so `yieldBox.toShare(assetId, totalBorrow.elastic, false)` rounds share to 0.
3. Allowance check on share==0 passes; assets are transferred to attacker without approval.
**How found:** Code review of removeAsset allowance check combined with the rounding-down in SGLCommon share computation; noticed share==0 makes the allowance check always succeed.
**Exploitation:** Any user calls removeAsset specifying a victim as owner and themselves as receiver with a small amount that rounds share to zero; the allowance check is bypassed and the victim's assets are transferred out. YieldBox shares becoming more expensive than borrow shares amplifies the rounding, increasing extractable amount.
**Escalation:** Repeated calls across many victims or larger rounding gaps as yieldBox share price diverges from borrow shares.
**Insight:** When an allowance/authorization check is performed on a derived (share) value rather than the raw amount, test whether rounding can drive that value to zero and bypass the check entirely.