# Withdrawals initiated after cycle withdrawal request won't be withdrawn in the correct cycle

Withdrawals requested after the once-per-cycle TOKE withdrawal submission are marked for the current cycle but never batched, causing token accounting mismatch and failed withdrawals.

- Payout: Contest reward
- Severity: medium
- Program: Yieldy
- Credited: 0x52
- Disclosed: 2022-09-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-yieldy-findings/issues/29
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-yieldy%3AM-07
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Yieldy staking/withdrawal contract (sendWithdrawalRequest / canBatchTransactions)
**Root cause:** canBatchTransactions requires currentCycleIndex > lastTokeCycleIndex, but sendWithdrawalRequest sets lastTokeCycleIndex = currentCycleIndex, so no further batching occurs within the same cycle even though new withdrawals are recorded against it.
**Steps:**
1. User calls sendWithdrawalRequest, setting lastTokeCycleIndex = currentCycleIndex and submitting TOKE withdrawal.
2. Later in the same epoch, another user requests a withdrawal; it is recorded against the current cycle.
3. canBatchTransactions returns false because currentCycleIndex is not > lastTokeCycleIndex, so the new withdrawal amount is never included in the TOKE requestWithdrawal.
4. At cycle end, recorded user withdrawal tokens exceed tokens actually requested/received, so eligible users cannot withdraw.
**How found:** Code reading of the cycle guard: noticed sendWithdrawalRequest mutates lastTokeCycleIndex to currentCycleIndex, making the canBatchTransactions condition false for the remainder of the cycle, then reasoned about withdrawals initiated after that point.
**Insight:** When a function both consumes a once-per-period guard and records new liabilities against that same period, check whether later entries in the period are silently excluded from the batched external call.