# getTargetExternalLendingAmount() when targetUtilization == 0  no check whether enough externalUnderlyingAvailableForWithdraw

getTargetExternalLendingAmount short-circuits to 0 when targetUtilization is 0, ignoring externalUnderlyingAvailableForWithdraw, so AAVE withdraw reverts and rebalancing to exit funds fails.

- Payout: Contest reward
- Severity: medium
- Program: Notional Update 5
- Credited: bin2chen
- Disclosed: 2023-12-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-notional-update-5-judging/issues/51
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-notional-update-5%3AM-12
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** ExternalLending.sol getTargetExternalLendingAmount / _rebalanceCurrency
**Root cause:** The targetUtilization == 0 short-circuit returns targetAmount=0 without clamping to externalUnderlyingAvailableForWithdraw, unlike the normal path which raises targetAmount to match available liquidity.
**Steps:**
1. Governance calls setRebalancingTargets() setting targetUtilization to 0 to exit external lending.
2. Flow reaches _rebalanceCurrency() -> _isExternalLendingUnhealthy() -> getTargetExternalLendingAmount().
3. With targetUtilization==0, function returns targetAmount=0 immediately.
4. Example: currentExternalUnderlyingLend=100, externalUnderlyingAvailableForWithdraw=99; correct targetAmount is 1, but 0 is returned.
5. AAVE withdraw of full amount exceeds available liquidity and reverts, so setRebalancingTargets() fails.
**How found:** Code reading of the short-circuit branch in getTargetExternalLendingAmount and comparing it to the later clamping logic that adjusts targetAmount against externalUnderlyingAvailableForWithdraw.
**Insight:** When a function has an early-return fast path, check whether the skipped logic enforced a safety clamp; here the zero-target shortcut bypasses the available-liquidity adjustment that the main path relies on.