# Market adapter removal corrupts withdraw sequence

AssetManager.removeAdapter reuses the moneyMarkets index to delete a withdrawSeq entry, corrupting the withdrawal priority array and potentially freezing withdrawals.

- Payout: Contest reward
- Severity: medium
- Program: Union
- Credited: hyh
- Disclosed: 2023-02-07
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-02-union-judging/issues/24
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-02-union%3AM-3
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** AssetManager.sol removeAdapter() in union-v2-contracts
**Root cause:** removeAdapter computes index against moneyMarkets but applies the same index to withdrawSeq, which is an independent permutation of moneyMarkets, so the wrong sequence entry is removed.
**Steps:**
1. Admin calls `removeAdapter(adapterAddress)` where adapterAddress sits at moneyMarkets index i.
2. Code finds `index = i` in moneyMarkets loop.
3. It then executes `withdrawSeq[index] = withdrawSeq[withdrawSeq.length - 1]; withdrawSeq.pop();`, deleting the entry at position i of withdrawSeq, not the entry equal to the removed adapter.
4. Result: withdrawSeq no longer matches moneyMarkets; the removed adapter may still appear in withdrawSeq and another market's priority is dropped.
**How found:** Code reading: noticed index derived from moneyMarkets loop is reused for withdrawSeq mutation, and that setWithdrawSequence allows an arbitrary permutation, so indices are independent.
**Exploitation:** Requires admin action (onlyAdmin). A mis-ordered withdrawSeq can leave the removed adapter referenced or drop a high-priority market, so withdraw logic iterating the sequence can revert or skip the market holding most funds, freezing withdrawals until setWithdrawSequence is manually restored.
**Insight:** When two parallel arrays are mutated together, verify the index domain of each: a permutation array (priority order) cannot share indices with the underlying set array.