# TrueFiStrategy: Too little withdrawn when used with AlphaBetaSplitter

AlphaBetaSplitter assumes withdrawAll returns full child balance, but TrueFiStrategy only returns liquid USDC, causing under-withdrawal of funds.

- Payout: Contest reward
- Severity: medium
- Program: Sherlock
- Credited: Lambda
- Disclosed: 2022-09-21
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-09-sherlock-judging/tree/main/003-M
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-09-sherlock%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** AlphaBetaSplitter / TrueFiStrategy vault strategy contracts
**Root cause:** AlphaBetaSplitter assumes withdrawAll() returns the entire child balance reported by _balanceOf(), but TrueFiStrategy's _balanceOf counts USDC locked in TrueFi while withdrawAll only returns USDC already held in the contract.
**Steps:**
1. Deploy AlphaBetaSplitter with TrueFiStrategy as first child holding 950k USDC locked in TrueFi and 50k USDC liquid.
2. Call _withdraw with _amount = 1,000,050 USDC, exceeding childOneBalance.
3. Splitter calls withdrawAll on child one, which returns only 50k liquid USDC.
4. Splitter withdraws _amount - childOneBalance = 50,050 from second child.
5. Total returned ~100k instead of 1,000,050 USDC.
**How found:** Code reading: noticed AlphaBetaSplitter implicitly assumes withdrawAll returns the full _balanceOf amount, then compared against TrueFiStrategy where _balanceOf includes locked TrueFi funds but withdrawAll only returns liquid USDC.
**Insight:** When a splitter/aggregator assumes withdrawAll() returns the full reported balance, check strategies whose _balanceOf includes illiquid or locked positions requiring a separate exit call (e.g. liquidExit) — the accounting mismatch causes silent under-withdrawal.