# SavingsAccount withdrawAll and switchStrategy can freeze user funds by ignoring possible strategy liquidity issues

SavingsAccount.withdrawAll and switchStrategy assume full strategy withdrawal succeeds; on partial Aave liquidity, accounting deletes user entry while funds remain frozen.

- Payout: Audit contest
- Severity: high
- Program: Sublime
- Found by: hyh
- Disclosed: 2022-02-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-sublime-findings/issues/80
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-07
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** SavingsAccount / AaveYield strategy contracts
**Root cause:** withdrawAll and switchStrategy perform a single unlockTokens call and update accounting as if the full amount was withdrawn, ignoring the actual amount returned when the strategy (Aave) has insufficient liquidity.
**Steps:**
1. User calls `withdrawAll`; contract calls `unlockTokens` once on AaveYield.
2. Aave pool has high utilization; only partial amount is returned.
3. Contract deletes the user's savings entry anyway (`SavingsAccount.sol#L294,#L312`), leaving residual funds stuck in strategy.
4. Similarly `switchStrategy` subtracts full `_amount` shares from old strategy but adds only `_tokensReceived` to new one (`#L181`), freezing the difference.
**How found:** Code review of withdrawAll/switchStrategy noting single unlockTokens call without checking returned amount, cross-referenced with AaveYield.unlockTokens which does not match return to requested amount.
**Exploitation:** Not an active attack; triggered when a user withdraws during strategy liquidity shortage, causing partial withdrawal to be recorded as full and residual funds locked.
**Insight:** When a vault/strategy wrapper calls an external yield source, always reconcile the actual tokens received against the requested amount before mutating share accounting; single-shot withdrawals from lending pools can silently return less.