# MultiStrategy#removeStrategy() cannot remove leverage strategies that still have deployed assets

MultiStrategy.removeStrategy undeploys a leverage strategy and reallocates the requested amount, but flash-loan fees mean fewer assets return, causing under-allocation and reverts.

- Payout: Audit contest
- Severity: medium
- Program: BakerFi
- Credited: 0xpiken
- Disclosed: 2025-02-26
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-bakerfi-invitational#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AM-03
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** MultiStrategyVault / leverage strategy (Solidity contracts)
**Root cause:** removeStrategy assumes undeploy(strategyAssets) returns exactly strategyAssets, but leverage strategy undeploy nets out flash-loan fees, returning less; the vault then tries to allocate more than it received.
**Steps:**
1. Deploy a leverage strategy with collateral and debt via flash loan.
2. Call `MultiStrategy.removeStrategy(index)` where the strategy has `totalAssets() > 0`.
3. Inside `_undeploy`, deltaDebt is flash-borrowed, debt repaid, collateral withdrawn and swapped, and `deltaDebt + fee` repaid to flashLender.
4. receivedAmount = deltaCollateralInDebt - deltaDebt, which is less than the requested strategyAssets by the flash fee.
5. `_allocateAssets(strategyAssets)` then allocates more than the vault actually holds, reverting or mis-accounting.
**How found:** Code reading of removeStrategy's undeploy-then-allocate pattern, noticing the leverage strategy's flash-loan fee makes received amount less than requested.
**Insight:** When a vault reallocates after undeploy, never assume the returned amount equals the requested amount for strategies that net fees (flash loans, swap slippage); check the return value of undeploy and allocate that.