# Utilization ratio can exceed 100% due to missing validation in withdrawal functions

Blend's withdraw functions skip the max-utilization check, letting a supplier withdraw enough to push utilization past 100%, distorting interest rates and risking insolvency.

- Payout: Contest reward
- Severity: high
- Program: Blend
- Credited: 0x007
- Disclosed: 2025-08-13
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2025-02-blend-v2-audit-certora-formal-verification#h-03
- Library page: https://bugbountylibrary.com/r/c4%3A2025-02-blend-v2-audit-certora-formal-verification%3AH-03
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** Soroban lending pool contract (actions.rs withdraw/withdraw_collateral)
**Root cause:** require_utilization_below_max is only called in apply_borrow; apply_withdraw and apply_withdraw_collateral reduce total_supply without re-validating utilization, so the ratio can exceed the configured max and even 100%.
**Steps:**
1. Set reserve max_util=0.9, b_supply=100, d_supply=89 (util ~89%).
2. User with supply position of 20 calls RequestType::Withdraw for the full 20.
3. build_actions_from_request processes withdrawal without invoking require_utilization_below_max.
4. Resulting reserve.utilization() returns 1.1125010 (>100%).
**How found:** Code review of actions.rs: noticed utilization validation only in apply_borrow, then reasoned that withdrawals shrink total_supply (the denominator) and tested a full withdrawal near max util.
**Exploitation:** A supplier withdraws their full supply in a market near max utilization; since the check is absent, utilization jumps above 100%, driving interest-rate model to extreme values and leaving backstop_interest unlendable, enabling liquidations and bad debt.
**Insight:** When a ratio invariant is enforced on one side (borrow increases numerator), check the inverse operation (withdraw decreases denominator) for the same guard; ratio-based limits need validation on both numerator and denominator changes.