# Withdrawing all funds at once to vault can be DoS attacked by frontrunning and locking dust

Attacker locks 1 wei of want tokens to the strategy via AuraLocker.lock, making _withdrawAll's zero-balance check revert and blocking strategy migration.

- Payout: Audit contest
- Severity: medium
- Program: BadgerDAO
- Found by: berndartmueller
- Disclosed: 2022-08-02
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-badger-findings/issues/92
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-badger%3AM-03
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** MyStrategy._withdrawAll / BaseStrategy.withdrawToVault (Solidity vault strategy)
**Root cause:** _withdrawAll requires balanceOfPool()==0 && LOCKER.balanceOf(strategy)==0 before migrating; any locked dust on the strategy address makes this check fail permanently until unlock.
**Steps:**
1. Deploy vault+strategy, deposit want, call vault.earn so strategy holds funds.
2. Governance calls strategy.prepareWithdrawAll.
3. Attacker calls `want.approve(locker,1)` then `locker.lock(strategy,1)` donating 1 wei locked to strategy.
4. Governance calls `vault.withdrawToVault()`; reverts with 'You have to wait for unlock or have to manually rebalance out of it'.
5. Migration/setStrategy fails as long as any wei remains locked to strategy.
**How found:** Code review of _withdrawAll's require on LOCKER.balanceOf(strategy)==0, noticing an external actor can donate locked tokens to the strategy address to satisfy the failure condition.
**Exploitation:** Front-run the governance migration transaction by locking a minimal amount of want tokens to the strategy address via AuraLocker.lock, forcing the require check to fail and blocking strategy replacement.
**Insight:** When a migration/withdraw guard checks an externally-influenceable balance (e.g. token balance of a contract address), anyone can donate dust to break it; look for require()s on balances attackers can inflate.