# `Vault::pullFunds` doesn't pull funds from underlying providers correctly

Vault::pullFunds breaks the provider loop when one provider's balance is below minimumPull, skipping later providers that hold enough funds, blocking withdrawals.

- Payout: Contest reward
- Severity: medium
- Program: Derby
- Credited: Ch_301
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-derby-judging/issues/273
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-derby%3AM-16
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Vault.sol pullFunds loop over underlying yield providers
**Root cause:** The loop uses `break` instead of `continue` when `amountToWithdraw < minimumPull`, so a provider with a tiny allocation terminates the pull loop before reaching providers with sufficient balance.
**Steps:**
1. Set two providers with allocations `[1000, 1000e6]`, `minimumPull = 1e6`, vault balance 0.
2. Request a pull of `100e6` (e.g. via withdrawal/rebalance).
3. `pullFunds` iterates provider 0: `shortage=100e6`, `balanceProtocol=1000`, `amountToWithdraw=1000`.
4. Check `if (amountToWithdraw < minimumPull) break;` triggers, exiting loop before provider 1.
5. Withdrawal fails despite 1000e6 available in provider 1.
**How found:** Code reading of the pullFunds loop; noticed the `break` on `amountToWithdraw < minimumPull` exits the entire loop rather than skipping the underfunded provider, then constructed a two-provider numeric example.
**Exploitation:** A malicious user can grief by allocating very small amounts to early providers (when they have no allocations), causing pullFunds to break early and blocking withdrawals or rebalances for other users.
**Insight:** When auditing loops that aggregate liquidity across multiple sources, check whether a per-iteration shortfall uses `break` vs `continue`; a single dust allocation can DoS the whole pull path.