# Controller does not raise an error when there's insufficient liquidity

yAxis Controller silently returns zero when strategy liquidity is insufficient, so a withdrawer burns shares for nothing; MEV sandwich drains value.

- Payout: Audit contest
- Severity: high
- Program: yAxis
- Found by: jonah1005
- Disclosed: 2021-11-10
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2021-09-yaxis-findings/issues/28
- Library page: https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AH-04
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Controller.sol withdraw path / vault share accounting
**Root cause:** Controller's withdraw loop does not revert when remaining _amount is nonzero after exhausting vault/controller/strategy liquidity, returning partial/zero tokens while the vault still burns the user's shares.
**Steps:**
1. Deposit DAI into vault via `vault.deposit(dai, amount)`.
2. Call `vault.withdrawAll(usdt)` when controller/strategy lacks USDT liquidity.
3. Observe Controller returns without reverting despite nonzero remaining `_amount`.
4. User's shares are burned but USDT balance received is zero.
**How found:** Code review of Controller withdraw loop (L577-622) noting missing revert on leftover `_amount`; combined with vault treating all tokens equally to construct MEV sandwich.
**Exploitation:** MEV sandwich: attacker sees pending 1M DAI withdrawal; deposits USDC, withdraws all DAI liquidity from vault/controller/strategy, lets victim tx execute (victim burns 1M shares for zero DAI, pumping share price), then withdraws own liquidity at inflated share price.
**Escalation:** Any withdrawal is sandwichable; share price manipulation scales with victim size.
**Insight:** In vault/controller designs, check that withdraw loops revert on leftover amount — silent partial fills let an attacker starve liquidity right before a victim tx and profit from share-price inflation.