# Incorrect withdraw queue balance in TVL calculation

Renzo's calculateTVLs used outer loop index i instead of j when pricing withdraw-queue token balances, corrupting TVL used for mint/redeem.

- Payout: Contest reward
- Severity: high
- Program: Renzo
- Credited: pauliax
- Disclosed: 2024-06-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-04-renzo-findings/issues/28
- Library page: https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AH-08
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** RestakeManager.calculateTVLs TVL accounting
**Root cause:** Inner loop over collateralTokens indexes collateralTokens[i] (operator delegator index) instead of collateralTokens[j], so the same token's withdrawQueue balance is counted repeatedly and others skipped; reverts if ODs > tokens.
**Steps:**
1. Read RestakeManager.calculateTVLs: outer loop i over operatorDelegators, inner loop j over collateralTokens.
2. Observe totalWithdrawalQueueValue += renzoOracle.lookupTokenValue(collateralTokens[i], collateralTokens[j].balanceOf(withdrawQueue)) uses i.
3. With 1 OD and 3 tokens, first token's balance is added 3 times; other 2 tokens ignored.
4. With more ODs than collateral tokens, collateralTokens[i] reverts out of bounds.
5. Fix: use collateralTokens[j].
**How found:** Code reading of the nested TVL loop; noticed the outer-loop index i was reused to index the collateral token array inside the inner loop.
**Insight:** In nested loops over two arrays, verify each array is indexed by its own loop variable; a mismatched index silently duplicates one asset's value and can revert when array lengths differ.