# Incorrect calculation of queued withdrawals can deflate TVL and increase ezETH mint rate

OperatorDelegator.getTokenBalanceFromStrategy reads queuedShares[address(this)] (always 0) instead of address(token), so queued withdrawals are excluded from TVL, deflating it and over-minting ezETH.

- Payout: Contest reward
- Severity: high
- Program: Renzo
- Credited: LessDupes
- Disclosed: 2024-06-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-04-renzo-findings/issues/395
- Library page: https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AH-02
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** OperatorDelegator.getTokenBalanceFromStrategy / RestakeManager TVL calculation
**Root cause:** The function checks queuedShares[address(this)] which is always zero, instead of queuedShares[address(token)], so collateral queued for withdrawal is never added to the strategy balance used in TVL.
**Steps:**
1. Deploy Renzo with stETH at price 1e18, TVL starts at 0.
2. Alice deposits 100e18 stETH via `restakeManager.deposit(stETH, 100e18)`; TVL=100e18, ezETH minted=100e18.
3. Owner calls `operatorDelegator1.queueWithdrawals([stETH],[50e18])`.
4. Call `restakeManager.calculateTVLs()`; TVL drops to 50e18 because queued 50e18 is not counted.
5. New depositor mints ezETH against deflated TVL, receiving more ezETH per collateral than fair.
**How found:** Code review of getTokenBalanceFromStrategy: noticed the ternary guards on queuedShares[address(this)] while the body reads queuedShares[address(token)], an obvious key mismatch making the branch dead.
**Exploitation:** Attacker waits until a large OperatorDelegator withdrawal is queued (TVL artificially low), then deposits collateral to mint ezETH at an inflated rate, diluting existing holders and withdrawers.
**Insight:** In share/queue accounting, verify the mapping key used in the guard matches the key used in the body; address(this) vs address(token) mismatches silently zero out balances and skew TVL-based mint math.