# Potential 99.5% loss in emergencyWithdraw() of two Yieldbox strategies

LidoEthStrategy and ConvexTricryptoStrategy emergencyWithdraw computed minAmount as 0.5% instead of 99.5%, exposing 99.5% of withdrawn funds to sandwich slippage.

- Payout: Contest reward
- Severity: high
- Program: Tapioca DAO
- Credited: 0xfuje
- Disclosed: 2023-11-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-tapioca-findings/issues/494
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-tapioca%3AH-53
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** Yieldbox strategy contracts (LidoEthStrategy, ConvexTricryptoStrategy) emergencyWithdraw
**Root cause:** minAmount was computed as (calcWithdraw * 50)/10_000, i.e. 0.5% of the withdrawal, instead of calcWithdraw minus that 0.5% slippage tolerance, so the Curve exchange/remove_liquidity_one_coin min-out guard was effectively 0.5%.
**Steps:**
1. Read emergencyWithdraw() in LidoEthStrategy.sol#L108 and ConvexTricryptoStrategy.sol#L154.
2. Observe `uint256 minAmount = (calcWithdraw * 50) / 10_000;` yields 5 for calcWithdraw=1000.
3. Correct formula is `calcWithdraw - (calcWithdraw * 50) / 10_000` = 995.
4. minAmount is passed to curveStEthPool.exchange(1,0,toWithdraw,minAmount) and lpGetter.removeLiquidityWeth(lpBalance,minAmount) -> remove_liquidity_one_coin(_amount,_index,_min).
5. Attacker sandwiches the emergencyWithdraw tx, pushing price so output approaches the 0.5% floor.
**How found:** Compared the minAmount slippage formula in these two strategies against the standard pattern used in other Yieldbox strategies (`calcAmount - (calcAmount * 50)/10_000`), spotting the missing subtraction.
**Exploitation:** Owner calls emergencyWithdraw to exit all liquidity; attacker front-runs to skew the Curve pool price and back-runs to restore it, capturing up to 99.5% of the withdrawn value since the min-out guard only guarantees 0.5%.
**Insight:** When auditing slippage guards, verify the min-out is the amount minus tolerance, not the tolerance itself; grep all strategies for divergent minAmount formulas since copy-paste variants often invert the subtraction.