# Cannot withdraw tokens from all strategies in MultiStrategyVault when one third party is paused

MultiStrategyVault withdrawals iterate all strategies by asset share; one paused third-party strategy reverts undeploy, locking all user funds.

- Payout: Audit contest
- Severity: medium
- Program: BakerFi
- Credited: klau5
- Disclosed: 2025-02-26
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-bakerfi-invitational#m-12
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AM-12
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** MultiStrategyVault / MultiStrategy.sol strategy allocation logic
**Root cause:** _deallocateAssets and removeStrategy call undeploy on every strategy proportional to its totalAssets share, with no way to skip a paused/unavailable strategy; weight=0 only excludes deposits, not withdrawals.
**Steps:**
1. Deploy MultiStrategyVault with two strategies (e.g. Aave V3 and another).
2. Deposit funds so both strategies hold assets.
3. Third party (Aave pool) gets paused; its undeploy reverts.
4. User calls withdraw -> _deallocateAssets loops all strategies, calls `IStrategy(_strategies[i]).undeploy(fractAmount)` on paused one -> revert.
5. Attempt removeStrategy(index) -> `undeploy(strategyAssets)` reverts, strategy cannot be removed.
6. Rebalance also reverts, funds permanently locked if pause is permanent.
**How found:** Code review of MultiStrategy.sol allocation/deallocation loops; noticed withdrawal splits by currentAssets share rather than weight, so weight=0 cannot exclude a paused strategy, and removeStrategy also undeploys before removal.
**Escalation:** If the third-party pool is permanently paused, all vault deposits become permanently locked (no withdraw, rebalance, or removeStrategy path).
**Insight:** When a vault distributes withdrawals proportionally to per-strategy totalAssets, weight-based exclusion only works for deposits; check whether any admin path (removeStrategy, rebalance) also touches the failing strategy, since that removes the escape hatch.