# Reth.sol: Withdrawals are unreliable and depend on excess RocketDepositPool balance which can brick the whole protocol

Reth derivative withdraws only via RocketTokenRETH.burn, which needs RocketDepositPool excess balance; when depleted, unstake and rebalanceToWeights brick.

- Payout: Contest reward
- Severity: high
- Program: Asymmetry Finance
- Credited: HollaDieWaldfee
- Disclosed: 2023-07-28
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-03-asymmetry-findings/issues/210
- Library page: https://bugbountylibrary.com/r/c4%3A2023-03-asymmetry%3AH-07
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** SafEth Reth derivative withdraw() / RocketTokenRETH.burn
**Root cause:** withdraw() relies solely on RocketTokenRETH.burn, which pulls ETH from RocketDepositPool excess balance and reverts when excess is insufficient, with no fallback swap path.
**Steps:**
1. Call SafEth.unstake or rebalanceToWeights which invokes Reth.withdraw(amount).
2. withdraw calls RocketTokenRETH.burn(amount).
3. burn calls withdrawDepositCollateral -> rocketDepositPool.withdrawExcessBalance(ethRequired - contractBalance).
4. withdrawExcessBalance reverts on `require(_amount <= getExcessBalance())` when excess balance is depleted.
5. Withdrawal fails, bricking unstake and rebalanceToWeights.
**How found:** Code-reading of the Reth derivative withdraw path traced into RocketPool's burn -> withdrawDepositCollateral -> withdrawExcessBalance, spotting the excess-balance require as a liveness dependency.
**Exploitation:** Not an attacker-driven exploit; failure occurs naturally when RocketDepositPool excess balance is drained (users burning rETH or minipool capacity growth), making protocol withdrawals revert.
**Insight:** When integrating a derivative, trace the underlying redemption path to its actual liquidity source; wrapper burn functions may depend on transient pool 'excess balance' rather than the full collateral, so always provide a DEX-swap fallback.