# Collateral cannot be withdrawn from trove once yang is suspended

Opus Sentinel's convert_to_yang calls assert_can_enter, so suspended yangs block withdrawals, freezing collateral instead of letting users replace it.

- Payout: Contest reward
- Severity: medium
- Program: Opus
- Credited: 0xTheC0der
- Disclosed: 2024-03-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-01-opus-findings/issues/48
- Library page: https://bugbountylibrary.com/r/c4%3A2024-01-opus%3AM-07
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** Cairo smart contract (Sentinel/Abbot modules)
**Root cause:** abbot::withdraw routes through sentinel::convert_to_yang, which calls assert_can_enter and reverts with 'SE: Yang suspended' for Temporary or Permanent suspension, conflating deposit and withdrawal gating.
**Steps:**
1. Deploy abbot/sentinel and open a trove with a yang collateral.
2. As sentinel admin, call `sentinel.suspend_yang(asset_addr)`.
3. As trove owner, call `abbot.withdraw(trove_id, AssetBalance { address: asset_addr, amount: WAD_SCALE })`.
4. Observe revert `SE: Yang suspended` from `assert_can_enter`.
**How found:** Read the suspension documentation (no further deposits, threshold decays to zero over grace period) and reasoned users should be able to withdraw suspended collateral; traced abbot::withdraw -> convert_to_yang -> assert_can_enter and found the deposit-only assertion also gates withdrawals.
**Exploitation:** Not an attack; during an emergency suspension users cannot withdraw the suspended collateral to replace it with healthier collateral, so the trove cannot gradually recover. Only workaround is repaying all yin and closing the trove, which also withdraws all other yangs.
**Insight:** When a protocol documents a one-directional restriction (e.g. 'no deposits'), check whether the shared validation helper is reused on the opposite path (withdraw/exit); suspension and pause checks often over-block exits.