# `_unwrap` in `MultiInvoker.sol` can revert every time in some cases which will make the users not being able to `_liquidate` or `_withdraw` with `warp` to true

MultiInvoker._unwrap assumes redeem returns exactly the requested USDC amount; if DSU reserve is in debt, redeem returns less, so the transfer reverts, blocking liquidations and wrapped withdrawals.

- Payout: Contest reward
- Severity: medium
- Program: Perennial
- Credited: Vagner
- Disclosed: 2023-07-17
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-07-perennial-judging/issues/22
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-07-perennial%3AM-1
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:dos

**Target:** MultiInvoker.sol _unwrap / DSU reserve redeem integration
**Root cause:** _unwrap calls reserve.redeem(amount) then transfers the same fixed `amount` of USDC, but redeemAmount is computed from redeemPrice which drops below 1 when the DSU reserve is in debt, so less USDC arrives than the amount transferred.
**Steps:**
1. Call _liquidate (always wrap=true) or _withdraw/_vaultUpdate/_update with warp=true, which routes to _unwrap.
2. _unwrap checks batcher==0 or batcher USDC balance < amount, then calls reserve.redeem(amount).
3. ReserveComptroller computes redeemAmount = amount * redeemPrice where redeemPrice < 1 due to protocol debt.
4. Only redeemAmount (< amount) USDC is transferred to MultiInvoker.
5. _unwrap then transfers the full `amount` to receiver, reverting for insufficient balance, blocking liquidation/withdrawal.
**How found:** Code-reading of _unwrap's redeem-then-transfer flow, then tracing into the external DSU ReserveComptroller to notice redeemAmount is derived from redeemPrice/reserveRatio rather than being 1:1 with the input amount.
**Insight:** When integrating an external redeem/wrap protocol, never assume redeem(x) returns exactly x; read the external comptroller's price/ratio math and transfer the actual balance delta instead of the requested amount.