# Accounting will be broken if `output` token is one of the `lpTokens`

Beefy Velodrome strategy counts unharvested output-token fees as strategy balance when output equals an lpToken, inflating share price and causing depositor losses/insolvency.

- Payout: Contest reward
- Severity: medium
- Program: Beefy Cowcentrated Liquidity Manager
- Credited: DenTonylifer
- Disclosed: 2024-05-08
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-05-beefy-cowcentrated-liquidity-manager-judging/issues/71
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-05-beefy-cowcentrated-liquidity-manager%3AM-1
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Velodrome StrategyPassiveManager contract balances()/balancesOfThis()
**Root cause:** balances() sums erc20.balanceOf(this) with pool balances, but when the output/reward token is also lpToken0 or lpToken1, unharvested accrued fees held in the contract are counted as strategy assets.
**Steps:**
1. Deploy strategy on a Velodrome pool where output token (e.g. VELO) equals one of the lpTokens.
2. Accrue fees in the strategy contract via _chargeFees without harvesting.
3. Call balances(): balancesOfThis() returns balanceOf(this) for the lpToken, which now includes unharvested fees.
4. Deposit via vault at inflated share price; later harvest causes losses to those depositors.
**How found:** Code review of balances()/balancesOfThis() noticing that erc20.balanceOf includes unharvested fees, combined with observation that Velodrome gauges emit VELO which is also an lpToken in 37 pools.
**Exploitation:** No direct attacker extraction described; mispricing lets depositors mint shares against inflated NAV, and subsequent fee collection redistributes losses to those depositors, potentially rendering strategy insolvent.
**Insight:** When a strategy reports NAV via raw token balances, check whether reward/output tokens can coincide with the underlying LP tokens; unharvested fees then silently inflate share price.