# Withdrawal from NFTs can be temporarily blocked

Withdrawing from managed NFTs leaves nextWithdrawal > ManagedNFTs.length after NFT releases, permanently blocking revenue withdrawal until reset.

- Payout: Contest reward
- Severity: medium
- Program: Althea Liquid Infrastructure
- Credited: SpicyMeatball
- Disclosed: 2024-04-08
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-althea-liquid-infrastructure-findings/issues/82
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-althea-liquid-infrastructure%3AM-04
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** LiquidInfrastructureERC20.withdrawFromManagedNFTs
**Root cause:** nextWithdrawal is only reset when it exactly equals ManagedNFTs.length; if NFTs are released after a partial withdrawal, nextWithdrawal exceeds the array length and the loop never executes, so it never resets.
**Steps:**
1. Deploy 3 managed NFTs each holding 1M USDC.
2. Call `withdrawFromAllManagedNFTs()` to set nextWithdrawal = 3.
3. Release two NFTs via `releaseManagedNFT`, shrinking ManagedNFTs to length 1.
4. Mint new rewards to the remaining NFT and call `withdrawFromAllManagedNFTs()`; loop `for (i = nextWithdrawal; i < limit; i++)` never runs since nextWithdrawal(3) > length(1), so no withdrawal occurs and nextWithdrawal stays stuck.
**How found:** Code reading of the loop bound and reset condition: noticed nextWithdrawal only resets on exact equality with ManagedNFTs.length, then reasoned that releasing NFTs shrinks the array and breaks the equality.
**Exploitation:** Attacker frontruns or triggers NFT release after a partial withdrawal so nextWithdrawal exceeds the shrunken ManagedNFTs length, permanently blocking revenue withdrawal from remaining NFTs (DoS).
**Insight:** When a cursor/index is reset only on exact equality with a shrinking array length, look for any path that removes elements (release/burn) between iterations to strand the cursor past the end.