# Priority withdrawal sequence array will grow infinitely over time

AssetManager.removeAdapter shrinks moneyMarkets but not withdrawSeq, so each add/remove cycle grows withdrawSeq, bloating withdraw() gas toward fund freeze.

- Payout: Contest reward
- Severity: medium
- Program: Union Finance
- Credited: hyh
- Disclosed: 2022-11-04
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2022-10-union-finance-judging/issues/76
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-10-union-finance%3AM-9
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:dos

**Target:** AssetManager.sol withdraw sequence / adapter management
**Root cause:** removeAdapter() pops moneyMarkets but never shrinks withdrawSeq, and setWithdrawSequence() enforces parity with the stale withdrawSeq length rather than moneyMarkets length, so the array can only grow.
**Steps:**
1. Deploy AssetManager with N adapters; withdrawSeq length == moneyMarkets length.
2. Admin calls removeAdapter(addr): moneyMarkets shrinks by 1, withdrawSeq unchanged.
3. Admin calls addAdapter(newAddr): both push, but withdrawSeq now exceeds moneyMarkets by 1.
4. Repeat remove/add cycles; withdrawSeq length grows unbounded while moneyMarkets stays bounded.
5. Call withdraw(): loop iterates full withdrawSeq, gas cost rises with each cycle until block gas limit is exceeded.
**How found:** Code reading of addAdapter/removeAdapter/setWithdrawSequence revealed asymmetric array maintenance: removeAdapter omits withdrawSeq reduction while setWithdrawSequence enforces parity with withdrawSeq, locking in the growth.
**Exploitation:** No direct attacker action; admin adapter churn over time inflates withdrawSeq, raising withdraw() gas for all users until withdrawals become economically non-viable or exceed block gas limit.
**Escalation:** Temporal gas-cost freeze escalates to permanent fund freeze once withdrawSeq length pushes withdraw() past block gas limit.
**Insight:** When auditing paired add/remove admin functions, check that every parallel array or index structure is updated symmetrically on removal; parity checks against the wrong array can permanently lock in drift.