# YearnProvider freezes yearn tokens on partial withdrawal

YearnProvider.withdraw pulls full requested shares but Yearn may burn only part, leaving unused yTokens stranded on the provider contract with no recovery path.

- Payout: Contest reward
- Severity: high
- Program: Derby
- Credited: hyh
- Disclosed: 2022-10-17
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-01-derby-judging/issues/355
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-derby%3AH-4
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error

**Target:** YearnProvider.sol withdraw() in Derby yield optimiser
**Root cause:** withdraw() transfers the full _amount of yTokens from the caller and calls Yearn withdraw, but Yearn can burn fewer shares than requested during liquidity squeeze; the leftover shares remain on the provider balance with no return or retrieval logic.
**Steps:**
1. Vault calls withdrawFromProtocol, computing shares and approving provider
2. Provider.withdraw does `IYearn(_yToken).transferFrom(msg.sender, address(this), _amount)` pulling all shares
3. `IYearn(_yToken).withdraw(_amount)` returns only partial `uAmountReceived` when Yearn vault lacks liquidity (shares < maxShares)
4. Provider transfers only uAmountReceived to Vault; remaining `_amount - shares` yTokens stay on provider balance
5. No function exists to sweep or return these stranded shares
**How found:** Code review of YearnProvider.withdraw against Yearn Vault.vy withdraw semantics, noticing that Yearn's partial-withdrawal branch (value > vault_balance) burns fewer shares than requested while the provider assumes full consumption.
**Exploitation:** Not an attacker-driven exploit; occurs naturally during Yearn liquidity squeeze, causing permanent freeze of protocol funds proportional to the shortfall, translating to user losses.
**Insight:** When integrating a yield vault, check whether its withdraw can return less than requested (liquidity squeeze) and ensure the wrapper returns or accounts for unconsumed shares rather than assuming 1:1 burn.