# Excess funds withdrawn from the money market

Notional redeemed the full withdrawal amount from the money market instead of only the shortfall, leaving excess assets idle and losing yield.

- Payout: Contest reward
- Severity: high
- Program: Notional
- Credited: bin2chen
- Disclosed: 2023-03-09
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-notional-judging/issues/193
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-notional%3AH-6
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** TokenHandler._redeemMoneyMarketIfRequired (Notional proxy / money market redemption)
**Root cause:** getRedemptionCalldata is called with the full withdrawAmountExternal rather than the shortfall (withdrawAmountExternal - currentBalance), so the contract redeems more than needed from Compound/money market.
**Steps:**
1. Contract holds currentBalance = 999,900 USDC.
2. User requests withdrawAmountExternal = 1,000,000 USDC.
3. withdrawAmountExternal > currentBalance, so redemption path executes.
4. `oracle.getRedemptionCalldata(withdrawAmountExternal)` is called with 1,000,000 instead of 100.
5. 1,000,000 USDC redeemed from money market; 990,000 excess idles in Notional.
**How found:** Code reading of _redeemMoneyMarketIfRequired: noticed the redemption calldata uses the full withdrawal amount rather than the difference between withdrawal and current balance.
**Exploitation:** Attacker triggers withdrawals sized just above the contract's idle balance to force large redemptions from the money market, leaving funds idle and denying yield to the protocol/users (griefing).
**Insight:** When a contract tops up a withdrawal from an external pool, check whether the redemption amount is the shortfall or the gross amount; off-by-design here causes over-withdrawal and yield loss.