# `ratiosX96Value` rounds in favor of user and not vault

Mellow Vault's ratiosX96Value denominator rounds down in calculateStack, inflating coefficientX96 so withdrawals pay users slightly more than owed, slowly draining vault value.

- Payout: Contest reward
- Severity: medium
- Program: Mellow
- Credited: Ironsidesec
- Disclosed: 2024-06-04
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-mellow-judging/issues/61
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-mellow%3AM-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:regression technique:source-review vuln:precision-loss

**Target:** Vault.sol calculateStack / analyzeRequest withdrawal accounting
**Root cause:** ratiosX96Value is computed with FullMath.mulDiv (rounds down) and used as the denominator for coefficientX96, so a smaller denominator inflates the user's expectedAmounts. Vault-favoring rounding requires rounding the denominator up.
**Steps:**
1. Read calculateStack: `s.ratiosX96Value += FullMath.mulDiv(s.ratiosX96[i], priceX96, Q96)` rounds down.
2. In analyzeRequest, `coefficientX96 = FullMath.mulDiv(value, Q96, s.ratiosX96Value)` uses that value as denominator.
3. `expectedAmounts[i] = FullMath.mulDiv(coefficientX96, ratiosX96, Q96)` thus overpays the withdrawer.
4. Repeat withdrawals to accumulate small value loss from the vault.
5. Fix: use `FullMath.mulDivRoundingUp` for ratiosX96Value.
**How found:** Code review of rounding direction in calculateStack; noticed denominator rounding down inflates the coefficient, and cross-referenced a prior audit finding (M1) on the deposit function's rounding.
**Exploitation:** A depositor repeatedly withdraws; each withdrawal's expectedAmounts is slightly inflated because the denominator rounds down, extracting marginal value from remaining LPs until vault insolvency.
**Insight:** When a value is used as a divisor, rounding it down inflates the quotient; check every denominator's rounding direction against protocol-favoring convention, and reuse prior-audit rounding findings as a template for sibling functions.