# Withdrawable.withdraw does not decrease pendingWithdrawals

FairSide's Withdrawable.withdraw fails to decrement pendingWithdrawals, so getReserveBalance under-reports reserves and FSD.mint computes wrong mint amounts.

- Payout: Audit contest
- Severity: high
- Program: FairSide
- Disclosed: 2021-07-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-05-fairside-findings/issues/48
- Library page: https://bugbountylibrary.com/r/c4%3A2021-05-fairside%3AH-05
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error

**Target:** Withdrawable contract storage accounting (pendingWithdrawals / getReserveBalance)
**Root cause:** withdraw() pays out but never decrements pendingWithdrawals, unlike _increaseWithdrawal which increments it, so the tracked pending amount stays inflated after payout.
**Steps:**
1. Read `_increaseWithdrawal`, which increments `pendingWithdrawals` when a withdrawal is queued.
2. Read `withdraw`, which transfers the amount out but does not decrement `pendingWithdrawals`.
3. Observe `getReserveBalance` subtracts `pendingWithdrawals`, so it under-reports the real reserve balance.
4. Trace that under-reported reserve feeds the `FSD.mint` calculation, producing wrong mint amounts.
5. Fix: decrease `pendingWithdrawals` by the withdrawn amount in `withdraw`.
**How found:** Compared the semantics implied by the name `pendingWithdrawals` and the increment in `_increaseWithdrawal` against `withdraw`, noticing the missing symmetric decrement, then traced the stale value into getReserveBalance and FSD.mint.
**Exploitation:** Not described beyond the accounting error: stale pendingWithdrawals makes getReserveBalance under-report reserves, which feeds incorrect mint amounts in FSD.mint.
**Insight:** When a storage var is incremented on queue and decremented on settle, check every exit path for the matching decrement; stale accounting vars that feed balance/mint math silently corrupt downstream calculations.