# AutoPxGmx.maxWithdraw and AutoPxGlp.maxWithdraw functions calculate asset amount that is too big and cannot be withdrawn

AutoPxGmx/AutoPxGlp inherit PirexERC4626.maxWithdraw without accounting for withdrawalPenalty, so maxWithdraw returns too many assets and withdraw reverts.

- Payout: Contest reward
- Severity: medium
- Program: Redacted Cartel
- Credited: aphak5010
- Disclosed: 2023-01-27
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-11-redactedcartel-findings/issues/97
- Library page: https://bugbountylibrary.com/r/c4%3A2022-11-redactedcartel%3AM-04
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** ERC-4626 vault contracts (AutoPxGmx, AutoPxGlp)
**Root cause:** AutoPxGmx and AutoPxGlp add a withdrawalPenalty in previewWithdraw but do not override maxWithdraw, so maxWithdraw reports pre-penalty assets that exceed what withdraw can actually burn.
**Steps:**
1. Call `maxWithdraw(owner)` on AutoPxGmx; it returns convertToAssets(balanceOf(owner)) without subtracting penalty
2. Call `withdraw(returnedAmount, receiver, owner)`
3. withdraw calls `previewWithdraw`, which inflates shares by withdrawalPenalty
4. `burn` of inflated shares exceeds owner balance and reverts
**How found:** Code reading of ERC-4626 inheritance: noticed AutoPxGmx/AutoPxGlp override previewWithdraw to add a penalty but never override inherited maxWithdraw, creating inconsistency between maxWithdraw and withdraw.
**Insight:** When a vault overrides previewWithdraw/previewRedeem to add fees, check that maxWithdraw/maxRedeem are also overridden; inherited ERC-4626 max functions assume no fee and will overstate withdrawable amounts.