# Partial withdrawals don't work with Elixir strategy

ElixirStrategy computes withdrawal ratio from user-supplied shares instead of cooled-down shares, letting a user withdraw 1 wei to claim full cooldown as yield and double collateral.

- Payout: Contest reward
- Severity: high
- Program: Jigsaw
- Credited: SpicyMeatball
- Disclosed: 2025-08-11
- Write-up quality: 7/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_jigsaw_june2025.pdf#3.1.8
- Library page: https://bugbountylibrary.com/r/cantina%3Ajigsaw_june2025%3A3.1.8
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:cantina sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** ElixirStrategy.sol / stdeUSD.sol withdrawal logic
**Root cause:** Withdraw computes shareRatio from the caller-supplied _shares rather than the shares actually placed on cooldown; unstake returns the full cooled-down amount, which is then booked as yield instead of principal.
**Steps:**
1. Invest 1000e6 USDT into Elixir strategy via strategyManager.invest
2. Call strategy.cooldown(userHolding, totalShares) to cool down all shares
3. Skip 7 days cooldown
4. Call strategyManager.claimInvestment with _shares: 1
5. Observe full cooled-down amount unstaked and recorded as yield, doubling collateral registry value
**How found:** Code review of withdraw path noticing shareRatio derived from params.shares while unstake returns full cooled-down balance; confirmed with fork PoC.
**Exploitation:** User cools down all shares, then withdraws with _shares=1 so shareRatio≈0 and investment≈0; unstake returns full amount, withdrawnAmount minus ~0 investment is booked as yield, inflating collateral at no cost.
**Escalation:** Inflated collateral can be used to borrow more than deposited, amplifying funds extraction.
**Insight:** When a two-step cooldown/claim flow exists, check that the claim step binds accounting to the amount actually queued on cooldown, not a fresh user-supplied parameter.