# Removing token from the whitelist may cause DoS due to limited USDC amount

Removing a USDC version from asdUSDC whitelist strands its backing balance, letting remaining holders drain the other version and DoS withdrawals.

- Payout: Audit contest
- Severity: medium
- Program: Canto
- Found by: SpicyMeatball
- Disclosed: 2024-05-03
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-03-canto#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-canto%3AM-03
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** asdUSDC withdraw() whitelist check
**Root cause:** withdraw() requires the USDC version to be whitelisted, so de-whitelisting a version locks its usdcBalances while asdUSDC supply remains redeemable against other versions.
**Steps:**
1. Set usdcBalances[usdc1]=1000, usdcBalances[usdc2]=500, asdUSDC supply=1500
2. Owner removes usdc2 from whitelistedUSDCVersions
3. usdc2 holders call `withdraw(usdc1, 500)` since usdc2 now reverts on the require
4. usdc1 balance drops to 500, leaving 1000 asdUSDC unbacked; remaining holders cannot withdraw
**How found:** Code review of withdraw()'s whitelist require combined with reasoning about accounting when a backing asset is removed from the whitelist.
**Exploitation:** Any holder of asdUSDC backed by the de-whitelisted version front-runs others by withdrawing against the still-whitelisted version, draining its balance and leaving later withdrawers unable to redeem.
**Insight:** In multi-asset vaults, check what happens to accounting invariants when an admin removes an asset from an allowlist: supply stays constant while redeemable backing shrinks, enabling a first-mover drain.