# BalancerStrategy _withdraw uses BPT_IN_FOR_EXACT_TOKENS_OUT which can be attack to cause loss to all depositors

BalancerStrategy withdraw uses BPT_IN_FOR_EXACT_TOKENS_OUT with no slippage cap, letting an attacker imbalance the pool so one withdrawal burns all BPT and socializes loss.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: GalloDaSballo
- Disclosed: 2023-11-16
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/1449
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-06
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** BalancerStrategy.sol _vaultWithdraw / Balancer Vault exitPool
**Root cause:** Withdraw encodes ExitKind 2 (BPT_IN_FOR_EXACT_TOKENS_OUT) with pool.balanceOf(this) as max BPT in and minAmountsOut only guarding the WETH leg, so any slippage is accepted and all BPT can be burned for one user's withdrawal.
**Steps:**
1. Deposit WETH into strategy so it holds BPT shares.
2. Imbalance the Balancer pool so the WETH leg requires far more BPT than pro-rata.
3. Call strategy withdraw for a single depositor's amount; exitRequest.userData = abi.encode(2, minAmountsOut, pool.balanceOf(address(this))) burns all BPT.
4. Rebalance pool to capture the excess value extracted from the strategy.
**How found:** Code review of _vaultWithdraw: noticed userData hardcodes exit kind 2 and passes pool.balanceOf(this) as BPT-in, meaning unlimited slippage; cross-referenced Balancer ExitKind enum and prior Yearn disclosure of the same pattern.
**Exploitation:** Attacker imbalances the pool (single-sided exposure) then triggers a withdrawal; the strategy burns its entire BPT balance to satisfy one user's WETH out, socializing the loss across all depositors while the attacker profits from the rebalanced pool.
**Escalation:** Loss is socialized: one withdrawal can burn everyone's shares, causing total loss to all stakers.
**Insight:** When a strategy withdraws from a Balancer/AMM pool, check the exit/join kind and whether max BPT-in is bounded; BPT_IN_FOR_EXACT_TOKENS_OUT with full balance as input is a classic single-sided-exposure drain.