# No withdrawal possible for ETH TOKE pool

Yieldy's Staking contract calls Tokemak ETH pool withdraw without the required asEth boolean, so ETH/WETH stakers can never withdraw and funds stay locked.

- Payout: Contest reward
- Severity: high
- Program: Yieldy
- Credited: Lambda
- Disclosed: 2022-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-yieldy-findings/issues/87
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-yieldy%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** Staking contract integrating Tokemak ETH/WETH pool
**Root cause:** Tokemak's EthPool.withdraw takes an extra asEth boolean unlike other pools; Yieldy's generic withdraw call omits it, so the call reverts for ETH/WETH staking tokens.
**Steps:**
1. Deploy Staking with WETH/ETH as staking token.
2. Deposit into Tokemak via the contract (succeeds).
3. Call withdraw; the call to EthPool.withdraw lacks the asEth parameter and reverts, locking funds.
**How found:** Compared Tokemak's EthPool.withdraw signature (source and deployed bytecode on Etherscan) against the USDC pool, noticing the extra asEth parameter the integration did not supply.
**Insight:** When integrating third-party pools, diff each pool variant's ABI against the generic interface you coded to; special-case pools (native ETH) often add parameters that silently break shared call paths.