# depositYBLendSGLLockXchainTOLP function of the MagnetarAssetXChainModule will not work because it transfers Singularity tokens to the user before _withdrawToChain

MagnetarAssetXChainModule.depositYBLendSGLLockXchainTOLP reverts because _wrapSglReceipt sends wrapped TOFT tokens to the user before _withdrawToChain tries to withdraw them from the contract.

- Payout: Contest reward
- Severity: medium
- Program: Tapioca DAO
- Credited: KIntern\_NA
- Disclosed: 2024-05-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-tapioca-findings/issues/157
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-tapioca%3AM-06
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity vuln:business-logic

**Target:** MagnetarAssetXChainModule / MagnetarAssetCommonModule Solidity contracts
**Root cause:** _wrapSglReceipt wraps SGL into tReceipt TOFT and immediately transfers the TOFT to the user, leaving no tokens or YieldBox shares in the contract; _withdrawToChain then attempts to withdraw from address(this) and reverts.
**Steps:**
1. Call `depositYBLendSGLLockXchainTOLP(data)` with valid depositData and singularity.
2. `_depositYBLendSGL` lends into SGL and returns fraction.
3. `_wrapSglReceipt` wraps fraction into tReceipt TOFT and `safeTransfer`s toftAmount to `data.user`.
4. `_withdrawToChain` is invoked with `withdraw: true`, attempting to withdraw assetId shares from `address(this)`.
5. Contract holds zero shares/tokens, so withdrawal reverts and the whole tx fails.
**How found:** Code reading of the deposit flow: noticed _wrapSglReceipt transfers wrapped tokens to the user, while _withdrawToChain later withdraws from address(this), a state mismatch that guarantees revert.
**Insight:** When auditing multi-step deposit/send flows, trace token custody at each hop: any helper that forwards wrapped tokens to the user before a later step that pulls from the contract's own balance will break the flow. Check ordering of wrap/transfer vs. withdraw-from-self.