# updateYieldStrategy will freeze some funds with the old Strategy if yieldStrategy fails to withdraw all the funds because of liquidity issues

updateYieldStrategy removes the old strategy even when withdrawAll only partially succeeds due to lending-market liquidity crunch, freezing remaining funds in the orphaned strategy.

- Payout: Audit contest
- Severity: medium
- Program: Sherlock
- Found by: hyh
- Disclosed: 2022-05-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-01-sherlock-findings/issues/76
- Library page: https://bugbountylibrary.com/r/c4%3A2022-01-sherlock%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Sherlock core contract / yield strategy manager (AaveV2Strategy)
**Root cause:** updateYieldStrategy calls yieldStrategy.withdrawAll and then unconditionally replaces the strategy pointer, but withdrawAll is not guaranteed to return all funds when the underlying lending market has high utilization; the old strategy's withdraw functions are gated by onlySherlockCore with an immutable Sherlock address, so the orphaned remainder can only be recovered by switching back.
**Steps:**
1. Deploy/observe Sherlock with an active AaveV2Strategy holding funds.
2. Drive the lending market to high utilization so withdrawAll cannot return the full balance.
3. Owner calls `updateYieldStrategy(newStrategy)`; it calls `yieldStrategy.withdrawAll()` which returns partial funds.
4. Contract still sets the new strategy and drops the old one; remaining funds stay in old strategy.
5. Old strategy's `withdraw`/`withdrawAll` are `onlySherlockCore` and Sherlock is immutable, so funds are stuck until a back-and-forth strategy switch.
**How found:** Code reading of updateYieldStrategy's unconditional strategy replacement combined with knowledge that peer-to-peer lending withdrawAll can fail under high utilization; cross-checked the onlySherlockCore modifier and immutable Sherlock address in Manager.sol to confirm the orphaned funds are unreachable.
**Insight:** When a migration/upgrade function assumes a withdraw-all succeeds, check whether the underlying protocol can return partial amounts (lending utilization, share-based vaults) and whether the old module's access control still permits recovery after the pointer is swapped.