# Insufficient Funds Due to Incorrect Amount Comparison

In Citrea's choose_utxos, the smaller-UTXO loop compares cumulative sum against the remaining gap instead of the original target, selecting UTXOs totaling less than the required amount.

- Payout: Contest reward
- Severity: medium
- Program: Citrea
- Credited: Petrus
- Disclosed: 2025-10-21
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_citrea_jul2025.pdf#3.2.4
- Library page: https://bugbountylibrary.com/r/cantina%3Acitrea_jul2025%3A3.2.4
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium technique:source-review vuln:accounting-error vuln:business-logic

**Target:** UTXO selection function choose_utxos
**Root cause:** After subtracting the required UTXO from amount, the loop still compares sum (which includes the required UTXO) against the reduced remaining amount, so the check passes before the original target is met.
**Steps:**
1. Set required UTXO = 40, target amount = 100, smaller UTXOs = [50].
2. After required UTXO: sum = 40, amount = 60.
3. Add 50 to sum: sum = 90.
4. Check `sum >= amount` → 90 >= 60 → true, loop breaks.
5. Result: selected 90 total, below target 100.
**How found:** Code reading of choose_utxos: noticed amount is mutated to the remaining gap while sum still includes the required UTXO, making the loop's comparison inconsistent.
**Insight:** When a loop mutates a running total and a remaining-gap variable in parallel, check that the termination condition compares like with like; a mutated 'amount' compared against a cumulative 'sum' silently under-selects.