# Normal users could be inadvertently grieved by the withdrawn ratios check

Olympus BLVaultLido withdraw slashes any wstETH imbalance vs oracle as treasury fee, so a user depositing into an already-skewed pool loses ~17% on immediate withdrawal.

- Payout: Contest reward
- Severity: medium
- Program: Olympus
- Credited: RaymondFam
- Disclosed: 2023-03-16
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-olympus-judging/issues/28
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-olympus%3AM-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** BLVaultLido deposit/withdraw vault (OHM/wstETH Balancer pool)
**Root cause:** Withdraw compares user's wstETH output against oracle-implied ratio and sends any excess to treasury; when the pool is already imbalanced, a fresh depositor's proportional exit looks like an arb and gets slashed.
**Steps:**
1. Pool starts 100_000 OHM / 1_000 wstETH, LP=10_000, oracle 100 OHM = 1 wstETH.
2. Swaps shift pool to 90_909.1 OHM / 1_100 wstETH.
3. Bob calls `deposit()` with 11 wstETH; 1100 OHM minted, 190.91 OHM burned, 909.09 OHM + 11 wstETH staked for 100 LP.
4. Bob immediately calls `withdraw()` for all LP; contract caps wstETH out at 909.09*0.01 = 9.09 wstETH, sends remainder to treasury/owner.
5. Bob loses 11 - 9.09 = 1.91 wstETH (~17.36%).
**How found:** Code review of withdraw ratio check against oracle price; simulated constant-product pool math to show an honest depositor's proportional exit exceeds oracle-implied wstETH amount and is treated as arb.
**Exploitation:** Not an attacker gain; griefing of naive users who deposit into an imbalanced pool and withdraw without waiting for rebalancing. Treasury captures the differential.
**Insight:** When a vault slashes 'excess' output vs an oracle, test deposits made into an already-skewed pool: proportional LP exit can exceed the oracle ratio without any manipulation, so the penalty hits honest users.