# Withdrawals logic allows MEV exploits of TVL changes and zero-slippage zero-fee swaps

Renzo WithdrawQueue prices withdrawals at request time with no fees, letting MEV bots sandwich TVL/oracle changes and use Renzo as a zero-slippage DEX.

- Payout: Contest reward
- Severity: high
- Program: Renzo
- Credited: guhu95
- Disclosed: 2024-06-07
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-04-renzo-findings/issues/326
- Library page: https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:fee-bypass vuln:oracle-manipulation

**Target:** WithdrawQueue.sol / RestakeManager.sol withdrawal and deposit pricing
**Root cause:** Withdrawal amount is computed from current oracle price/TVL at request submission rather than claim time, and deposits/withdrawals incur no proportional fee, so price changes between request and claim are captured by the requester.
**Steps:**
1. Observe pending tx that raises TVL (Chainlink oracle update, EigenLayer rewards withdrawal) without minting/burning ezETH.
2. Front-run: `deposit(assetA)` to mint ezETH at pre-update price.
3. Back-run: `withdraw(assetA)` to submit withdrawal request credited at post-update higher ezETH value.
4. After delay, `claim()` receives more assetA than deposited, netting profit minus gas only.
**How found:** Code reading of WithdrawQueue.withdraw showed amountToRedeem computed at request time (line ~220) while claim uses stored value; combined with fee-less deposit/withdraw and oracle/TVL-based pricing, identified sandwich and oracle-latency arbitrage.
**Exploitation:** Attacker sandwiches any TVL/oracle price increase with deposit before and withdrawal request after, capturing the delta at zero fee; alternatively deposits a depegging LST at inflated oracle price and withdraws a different asset (e.g. ETH) at pre-change price, using Renzo as a zero-slippage zero-fee oracle DEX up to TVL cap.
**Escalation:** Borrowing LSTs from lending protocols and buying on CEX/DEX to manipulate oracle price before depositing, then withdrawing another asset after the 7-day delay for outsized redemption.
**Insight:** When a vault prices redemptions at request time and charges no proportional fee, every TVL or oracle update becomes a free sandwich target; check whether conversion happens at request vs claim and whether min(request, claim) is enforced.