# The withdrawal of Multi strategies vault could be DoSed while asset deposits remain unaffected

MultiStrategy vault withdrawal reverts when a newly added strategy holds zero assets, since undeploy(0) reverts ZeroAmount, blocking all user withdrawals.

- Payout: Audit contest
- Severity: medium
- Program: BakerFi
- Credited: 0xpiken
- Disclosed: 2025-02-26
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-bakerfi-invitational#m-10
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AM-10
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** MultiStrategy vault _deallocateAssets / IStrategy.undeploy
**Root cause:** _deallocateAssets computes pro-rata fractAmount per strategy and calls undeploy even when fractAmount is 0; StrategySupplyBase reverts ZeroAmount() and StrategyLeverage reverts NoCollateralMarginToScale() on zero amount.
**Steps:**
1. Deploy MultiStrategy vault and deposit USDC via `vault.deposit(amount, owner)`
2. Add a fresh StrategySupplyERC4626 with no deployed assets via `vault.addStrategy(strategy)`
3. Call `vault.withdraw(amount, owner, owner)`
4. _deallocateAssets computes fractAmount=0 for the empty strategy and calls `undeploy(0)`, which reverts `ZeroAmount()`
**How found:** Code reading of _deallocateAssets loop: noticed pro-rata math yields 0 for strategies with totalAssets()==0 and that undeploy implementations revert on zero amount.
**Exploitation:** Any user withdrawal is blocked while an empty strategy is registered; no capital needed, just the strategy being added by VAULT_MANAGER before assets are allocated.
**Insight:** In pro-rata multi-strategy allocation loops, zero-weight strategies still get an undeploy call; check downstream undeploy/withdraw guards for zero-amount reverts that turn an empty strategy into a global withdrawal DoS.