# Withdrawing uncollateralized deposits is possible even though the position is in liquidation mode

Wise Lending lets users withdraw uncollateralized deposits while liquidatable because health check uses bare collateral instead of weighted collateral used by liquidation logic.

- Payout: Contest reward
- Severity: medium
- Program: Wise Lending
- Credited: 0xStalin
- Disclosed: 2024-05-03
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-02-wise-lending-findings/issues/260
- Library page: https://bugbountylibrary.com/r/c4%3A2024-02-wise-lending%3AM-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic vuln:liquidation

**Target:** WiseLending/WiseSecurity withdraw health check
**Root cause:** checksWithdraw returns true early for uncollateralized pools, setting powerFarmCheck=true so _healthStateCheck uses bare collateral (no collateralFactor) while checksLiquidation uses weighted collateral, creating a discrepancy.
**Steps:**
1. Have a position with bare collateral 1.5e18, weighted collateral 1.2e18, borrows 1.3e18 (liquidatable since weighted < borrows).
2. Call withdraw on an uncollateralized pool token.
3. WiseCore._coreWithdrawToken calls WiseSecurity.checksWithdraw, which returns true for uncollateralized token, setting powerFarmCheck=true.
4. WiseLending._healthStateCheck uses overallETHCollateralsBare: 1.5e18 * 95% = 1.425e18 > 1.3e18 borrows, so withdrawal succeeds.
5. Position remains liquidatable per checksLiquidation (weighted 1.2e18 < 1.3e18) but user removed uncollateralized funds.
**How found:** Compared the collateral valuation path in _healthStateCheck (bare vs weighted depending on powerFarmCheck) against checksLiquidation which always uses weightedCollateral, spotting the early return in checksWithdraw for uncollateralized pools.
**Exploitation:** A borrower whose position is liquidatable withdraws their uncollateralized deposit instead of using it to repay, reducing funds available to lenders and worsening bad debt; no capital or flash loan needed.
**Insight:** When a protocol has two health checks (withdraw vs liquidate), diff which collateral valuation each uses; an early-return or flag that switches to bare collateral can let a liquidatable position still withdraw.