# maxWithdraw() and maxRedeem() doesn't return correct value which can make other contracts fail while working with protocol

TokenggAVAX maxWithdraw/maxRedeem use totalAssets (incl. streaming rewards) instead of totalReleasedAssets, returning amounts that underflow and revert on withdraw.

- Payout: Contest reward
- Severity: medium
- Program: GoGoPool
- Credited: unforgiven
- Disclosed: 2023-03-21
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-12-gogopool-findings/issues/476
- Library page: https://bugbountylibrary.com/r/c4%3A2022-12-gogopool%3AM-16
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** TokenggAVAX ERC4626 vault contract (maxWithdraw/maxRedeem view functions)
**Root cause:** maxWithdraw/maxRedeem compute available liquidity as totalAssets() - stakingTotalAssets, but beforeWithdraw subtracts from totalReleasedAssets; since totalAssets includes current-cycle streaming rewards, the returned max can exceed totalReleasedAssets and underflow on withdrawal.
**Steps:**
1. Set totalReleasedAssets=10000, stakingTotalAssets=1000, mid-cycle rewards=2000 so totalAssets()=12000.
2. User holds 90% shares; maxWithdraw computes assets=10800, avail=totalAssets()-stakingTotalAssets=11000, returns 10800.
3. Call withdrawAVAX(10800): beforeWithdraw does totalReleasedAssets -= 10800 → 10000-10800 underflows and reverts.
4. Integrators doing `amount=maxWithdraw(user); withdrawAVAX(amount)` fail.
**How found:** Code reading of beforeWithdraw vs maxWithdraw/maxRedeem: noticed withdrawal subtracts from totalReleasedAssets while max functions use totalAssets() which includes streaming cycle rewards, making the view inconsistent with actual withdrawable balance.
**Insight:** When a vault streams rewards into totalAssets but tracks withdrawals against a separate released-assets counter, ERC4626 max* view functions must be bounded by the counter actually decremented in beforeWithdraw, not totalAssets.