# Withdrawal delay can be circumvented

prePO Collateral lets users transfer tokens after initiateWithdrawal, so two accounts alternating withdrawal initiations keep one always in a valid window and bypass the delay.

- Payout: Audit contest
- Severity: high
- Program: prePO
- Found by: cmichel
- Disclosed: 2022-05-09
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-03-prepo-findings/issues/54
- Library page: https://bugbountylibrary.com/r/c4%3A2022-03-prepo%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Collateral.sol withdrawal mechanism (Solidity smart contract)
**Root cause:** initiateWithdrawal records a per-account withdrawal request but does not lock or restrict transfers of the collateral tokens, so the balance backing a pending withdrawal can be moved to another account.
**Steps:**
1. Set _delayedWithdrawalExpiry = 20 blocks; account A holds 1000 collateral tokens.
2. At block 0, A calls `initiateWithdrawal(1000)` then transfers balance to account B.
3. At block 10, B calls `initiateWithdrawal(1000)` then transfers balance back to A.
4. Repeat alternating every 10 blocks so one account always satisfies `initiationBlock < block && block <= initiationBlock + 20`.
5. Withdraw from whichever account is currently in its valid window at any time.
**How found:** Code reading of Collateral.sol#L97: noticed initiateWithdrawal does not block subsequent transfers, so the withdrawal request is decoupled from the actual token balance.
**Exploitation:** Attacker maintains two (or more) accounts and ping-pongs the collateral balance between them, initiating a fresh withdrawal on each before transferring out, so a valid withdrawal window is always open and the delay is never enforced.
**Escalation:** Using several accounts circling withdrawals lets the attacker withdraw larger amounts even in the same block the tokens were purchased.
**Insight:** When a contract enforces a time delay on withdrawal, check whether the underlying balance can still be transferred after the request is recorded; per-account request state plus transferable balances lets you rotate accounts to keep a window open.