---
# System prepended metadata

title: Vaults v2 Issues and plan of action

---

# Vaults v2 Issues and plan of action

## Common patterns
1. How to report realized loss
2. How to report paper profit from a delegated vault-like strategy
3. How to share test templates

## Issues identified or discussions raised so far in testing
1. First harvest after migration reports all migrated assets as profit. Fixable by manually managing `reserve`. (Doug) should this be fixed in vault or individual strat?
2. Should we incorporate in the design for v2 a way to migrate vaults? e.g `VAT like`.
     (Doggie) maybe we can have a sort of escape hatch, where there is a designated withdrawal vat where we just put all the money in from both the Vault and all the strategies (bypassing their connected logic), and then we'll compute an accurate merkle claim tree for everyone to withdraw and claim their assets with
    Escape Hatch:
    1. Vault emergency shutdown
    2. Sweep all Vault funds to Claims
    3. Disable withdrawal queue
    4. Sweep all Strategy funds to Claims
    5. Wait for all funds to be collected in Claims
    6. Compute a merkle tree at the time of the incident (accounting for any collective losses, etc.)
    7. Add merkle tree to claims and open up withdrawals
3. Strategy could report incorrect numbers (Bug, unintentional), in that scenario what would be the steps to mitigate out of this issue? What is the Impact on Vault accounting of pricePerShare, etc?
4. Make `protectedTokens()` in BaseStrategy.sol a virtual to force implementation by strategy developer.
5. Does the BaseStrategy need to take care of reserve handling or it needs to be specifically implemented? (Discussion came from issues regarding this brought up by several strategists)
6. self.totalDebt is not lowered by removing a strategy. And that is used to determine the price per share and how much users get out when withdrawing. (Sam)
7. Should strategies report realized losses along with profits?
8. Potential theoretical attack vector: (Sam)
    1. Wait for harvest call
    2. Do a massive deposit to vault at 1 wei higher gas price
    3. Do a full withdrawl from vault at 1 wei lower gas price
    4. 
    5. At deposit you get a share based on the total debt at last harvest. not including accumulated return. 
    6. Harvest will pay out that return and update the total debt
    7. withdrawal will therefore get a share of it
    8. an attacker could theoretically capture most of the reported profit at each harvest


## Suggested Actions to Fix
1. TODO
2. TODO
3. TODO
4. (Carlos) I will take care of making `protectedTokens()` abstract
5. TODO
6. TODO
7. TODO
8. (Luciano) Reducing shares on deposit may mitigate the attack making it unprofitable?



## NOTES/ Comments


