# backdoor in withdrawRedundant

Vault.withdrawRedundant's else-if branch lets owner transfer the entire underlying token balance when balance equals token balance, rugging all user deposits.

- Payout: Audit contest
- Severity: high
- Program: InsureDAO
- Found by: cmichel
- Disclosed: 2022-03-15
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-insure-findings/issues/252
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-insure%3AH-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Vault.withdrawRedundant (Solidity smart contract)
**Root cause:** The condition `_token == address(token) && balance < tokenBalance` is false when balance equals tokenBalance, so execution falls into the else-if branch which transfers the full token balance instead of only the redundant amount.
**Steps:**
1. Deposit into Vault so balance == IERC20(token).balanceOf(address(this))
2. Owner calls `vault.withdrawRedundant(vault.token(), attacker)`
3. First if is false (balance not < tokenBalance), so else-if branch executes
4. `IERC20(_token).safeTransfer(_to, IERC20(_token).balanceOf(address(this)))` transfers entire vault balance to attacker
**How found:** Code review of withdrawRedundant logic; noticed the else-if branch is reachable for the vault token itself when balance equals token balance, causing full-balance transfer instead of only redundant funds.
**Exploitation:** Malicious/compromised owner calls withdrawRedundant with the vault token and an attacker address; the else-if branch transfers the full token balance, stealing all user deposits.
**Insight:** When auditing privileged 'sweep/redundant' functions, check whether the accounting variable can equal the actual token balance, making the 'excess' branch fall through to a full-balance transfer path.