# Incorrect Asset Redemption in Vault Withdrawal Leading to Loss of Funds

TermMaxVault withdrawal shortfall branch transfers only amountLeft after subtracting vault balance, but burns shares for the full amount, underpaying users.

- Payout: Contest reward
- Severity: high
- Program: Term Structure
- Credited: mohitisimmortal
- Disclosed: 2025-03-20
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_term_structure_february2025.pdf#3.1.6
- Library page: https://bugbountylibrary.com/r/cantina%3Aterm_structure_february2025%3A3.1.6
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:precision-loss

**Target:** TermMaxVault / OrderManager.withdrawAssets (ERC4626 vault)
**Root cause:** In the else branch, amountLeft -= assetBalance subtracts the vault's own balance from the transfer amount, but the vault's balance is never transferred; shares are burned for the full requested amount.
**Steps:**
1. Deploy vault, market, order; user2 deposits 1200e8 debt tokens
2. Call `vault.withdraw(1200e8, user2, user2)` while vault holds only 200e8
3. Observe user2 receives only 200e8 but shares burned for full 1200e8
4. Second `vault.withdraw(100e8, user2, user2)` reverts with `ERC4626ExceededMaxWithdraw`
**How found:** Code review of OrderManager.withdrawAssets shortfall branch noticing amountLeft is decremented by assetBalance but only amountLeft is transferred, while share burn uses the full amount.
**Exploitation:** Any user withdrawing more than the vault's idle asset balance triggers the shortfall branch; they receive only the redeemed shortfall while their full share amount is burned, permanently losing the untransferred portion.
**Insight:** In ERC4626-style vaults with external order redemption, verify that the amount transferred equals the amount of shares burned; watch for `amount -= balance` patterns where the subtracted balance is never actually sent.