# If a STRATEGY TOKEN is "Toggled off" STRATEGIES will still be able to withdraw, but returning of tokens with replenishReserves will be disabled.

BranchPort.manage lacks an enabled-token check, so disabled strategy tokens can still be withdrawn by strategies while replenishReserves is blocked, trapping funds.

- Payout: Contest reward
- Severity: high
- Program: Maia DAO Ecosystem
- Credited: yellowBirdy
- Disclosed: 2023-09-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-05-maia-findings/issues/882
- Library page: https://bugbountylibrary.com/r/c4%3A2023-05-maia%3AH-01
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** BranchPort.sol (Ulysses Omnichain) manage/replenishReserves
**Root cause:** manage() validates strategy registration but not whether the strategy token is enabled, while replenishReserves() requires the token to be enabled; toggling a token off leaves asymmetric access.
**Steps:**
1. Register a strategy for a token via BranchPort.
2. Call toggleStrategyToken() to disable the token while the strategy still holds debt.
3. Strategy calls manage() to withdraw tokens — succeeds despite token disabled.
4. Attempt replenishReserves() to force return — reverts because token is not enabled.
5. Tokens remain stuck/withdrawable only by strategy, not force-returnable.
**How found:** Code reading of manage() vs replenishReserves() access checks: noticed manage() omits the isStrategyToken enabled check that replenishReserves() enforces, creating an asymmetric state when a token is toggled off.
**Exploitation:** A registered strategy continues withdrawing managed tokens after the token is toggled off, while the protocol's forced-return path (replenishReserves) is disabled, preventing recovery of the tokens.
**Insight:** When two functions gate the same resource with different checks, compare their guards: an enabled-flag enforced on the return path but not the withdraw path lets a disabled asset still be drained but not recovered.