# Through rebalance(), an executor can drain 100% of vault reserves by minting cheap shares

Malicious executor passes fake router to ValantisHOTModule.swap during rebalance, mints 100e18 vault shares at near-zero price, drains 99% of vault reserves.

- Payout: Contest reward
- Severity: high
- Program: Arrakis
- Credited: juaan
- Disclosed: 2024-03-02
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2024-03-arrakis-judging/issues/44
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-03-arrakis%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:business-logic vuln:share-inflation

**Target:** ArrakisStandardManager.rebalance / ValantisHOTModule.swap
**Root cause:** swap() makes an arbitrary call to an unchecked router_ address after withdrawing all pool liquidity, so the executor can invoke vault.mint() while reserves are near zero, pricing shares at ~100 wei.
**Steps:**
1. Configure pool with rebase tokens (isToken0Rebase/isToken1Rebase=true) so reserves derive from balanceOf.
2. Deploy fake router with mintFreeShares() that transfers 1 wei of each token to the pool, approves module 100 wei, calls vault.mint(100e18, owner), then sends 1 wei token0 to module.
3. Call ArrakisStandardManager.rebalance(vault, [abi.encodeWithSelector(swap, false, 1, 1, scamRouter, 0, 0, mintFreeShares.selector)]) as executor.
4. swap() withdraws all liquidity, calls router_.call(payload) executing mintFreeShares, then re-deposits; expectedMinReturn=1 satisfied by the 1 wei transfer.
5. Call Vault.burn(100e18, attacker) to redeem shares for ~99% of pool reserves.
**How found:** Researcher noted README claims executor is RESTRICTED during rebalance, then read swap() and saw router_ is unchecked and that step 1 zeroes pool reserves before the arbitrary call, making share price manipulable; realized rebase tokens let reserves be inflated by direct transfer to bypass the zero-deposit revert.
**Exploitation:** Executor-only attack: during rebalance, swap() withdraws all pool liquidity, then the unchecked router_ call lets the executor mint 100e18 vault shares for 100 wei of each token (reserves inflated by 1 wei rebase transfer to bypass zeroTotalDepositAmount). After rebalance re-deposits funds, attacker burns shares and extracts ~99% of vault TVL in a single tx.
**Insight:** When a function withdraws all liquidity then makes an arbitrary external call before re-depositing, any share-price or reserve-dependent mint/burn reachable in that window is exploitable; rebase-token pools where reserves = balanceOf let you bypass zero-reserve guards with a 1 wei transfer.