# Strategist can fail to withdraw asset token from a private vault

Private Astaria vaults lack approve, so strategist withdrawals via router or Vault.withdraw revert, permanently locking deposited asset tokens.

- Payout: Contest reward
- Severity: high
- Program: Astaria
- Credited: rbserver
- Disclosed: 2023-05-22
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-01-astaria-findings/issues/489
- Library page: https://bugbountylibrary.com/r/c4%3A2023-01-astaria%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** Vault.sol withdraw / ERC4626RouterBase.withdraw
**Root cause:** Vault.withdraw uses safeTransferFrom(address(this), msg.sender, amount) but Vault has no approve function, so allowance is never set; router path also calls safeApprove on the vault which lacks approve.
**Steps:**
1. Create private vault via _createPrivateVault(strategistOne, strategistTwo)
2. strategistOne deposits 50 ether WETH: WETH9.approve(privateVault, amount); Vault(privateVault).deposit(amount, strategistOne)
3. Call ASTARIA_ROUTER.withdraw(IERC4626(privateVault), strategistOne, amount, type(uint256).max) -> reverts APPROVE_FAILED
4. Call Vault(privateVault).withdraw(amount) directly -> reverts TRANSFER_FROM_FAILED due to zero allowance
**How found:** Code reading of ERC4626RouterBase.withdraw and Vault.withdraw revealed reliance on approve/allowance that the Vault contract never implements.
**Exploitation:** No attacker; the strategist's own deposit becomes unrecoverable because both withdrawal paths revert, locking funds in the vault.
**Insight:** When a contract pulls its own tokens via transferFrom(address(this), ...), verify an approve path exists; ERC4626 router helpers that safeApprove the vault will break on vaults lacking approve.