# Rebalancing can be blocked when pulling funds from a TrueFi or a Idle vault

Derby Vault.rebalance deposits then withdraws from TrueFi/Idle vaults in one tx, which those protocols forbid, blocking rebalancing.

- Payout: Contest reward
- Severity: medium
- Program: Derby
- Credited: Jeiwan
- Disclosed: 2022-10-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-01-derby-judging/issues/327
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-derby%3AM-5
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Vault.rebalance yield-optimiser contract interacting with TrueFi/Idle vaults
**Root cause:** Vault.rebalance calls executeDeposits before pullFunds; TrueFi and Idle vaults revert when a deposit (join/mint) and withdrawal (exit/redeem) occur in the same block for the same tx.origin.
**Steps:**
1. Observe Vault.rebalance order: withdraw excess, executeDeposits, then pullFunds to cover reserved funds.
2. Configure allocations so rebalance both deposits into and then needs to pull from a TrueFi or Idle vault.
3. executeDeposits calls TrueFi join()/Idle mintIdleToken(), recording latestJoinBlock/_minterBlock for tx.origin.
4. pullFunds calls TrueFi liquidExit()/Idle _redeemIdleToken(), which require block.number != latestJoinBlock / _minterBlock and revert.
5. Rebalance reverts; team must top up vault balance to unblock.
**How found:** Code-reading of Vault.rebalance interaction ordering against TrueFi/Idle source, noticing both protocols enforce same-block deposit+withdraw restrictions keyed on tx.origin.
**Insight:** When integrating yield vaults, check whether the underlying protocol enforces same-block or same-tx deposit/withdraw guards (TrueFi latestJoinBlock, Idle _minterBlock); a rebalance that deposits before pulling reserved funds will always revert.