# StrategySupplyBase.undeploy does not return the amount of assets actually undeployed, which can cause a withdrawal to fail

StrategySupplyBase.undeploy returns the requested amount instead of the actual withdrawn amount, so withdrawals can revert when Morpho returns less than requested.

- Payout: Audit contest
- Severity: medium
- Program: BakerFi
- Found by: klau5
- Disclosed: 2025-02-26
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-bakerfi-invitational#m-16
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AM-16
- Tags: area:web3 domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** StrategySupplyBase / StrategySupplyMorpho vault strategy contracts
**Root cause:** undeploy returns the caller-supplied amount rather than the withdrawalValue returned by _undeploy, which may be lower when Morpho caps the withdrawal at available assets.
**Steps:**
1. Call StrategySupplyBase.undeploy(amount) where amount exceeds assets actually withdrawable from Morpho.
2. StrategySupplyMorpho._undeploy withdraws only assetsMax and returns assetsWithdrawn < amount.
3. undeploy ignores withdrawalValue and returns amount.
4. _redeemInternal treats returned amount as actual assets and attempts to transfer amount (minus fee) to receiver.
5. Transfer exceeds contract balance and reverts, blocking the withdrawal.
**How found:** Code review of undeploy return value versus _undeploy's actual withdrawal semantics in StrategySupplyMorpho, tracing the returned amount into _redeemInternal transfers.
**Insight:** When a wrapper returns a value from an internal call, verify it propagates the callee's actual result rather than the caller's requested input; strategies that cap withdrawals at available liquidity are prime spots for this mismatch.