# getTargetExternalLendingAmount() targetAmount may far less than the correct value

getTargetExternalLendingAmount caps targetAmount by maxExternalDeposit without subtracting currentExternalUnderlyingLend, forcing unnecessary withdrawals from external pools.

- Payout: Contest reward
- Severity: medium
- Program: Notional Update 5
- Credited: bin2chen
- Disclosed: 2023-12-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-notional-update-5-judging/issues/52
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-notional-update-5%3AM-13
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic

**Target:** ExternalLending.getTargetExternalLendingAmount() rebalancing logic
**Root cause:** maxExternalDeposit is a total supply-cap limit that already includes the protocol's currentExternalUnderlyingLend, but the code applies it as a cap on the absolute targetAmount rather than only on the incremental deposit.
**Steps:**
1. Read ExternalLending.getTargetExternalLendingAmount(): targetAmount = min(convertToExternal(targetExternalUnderlyingLend), maxExternalUnderlyingLend, oracleData.maxExternalDeposit).
2. Note oracleData.maxExternalDeposit is the remaining/absolute supply cap on the external pool that already counts currentExternalUnderlyingLend.
3. Set currentExternalUnderlyingLend=100, targetExternalUnderlyingLend=100, maxExternalUnderlyingLend=10000, maxExternalDeposit=0.
4. Observe targetAmount=0, so rebalance withdraws 100 instead of holding.
5. Fix: only apply maxExternalDeposit to the delta when targetAmount > currentExternalUnderlyingLend.
**How found:** Code reading of the min() cap logic; noticed maxExternalDeposit is a pool-level supply cap that includes existing protocol deposits, so applying it to the absolute target double-counts the current lend.
**Insight:** When a cap value is a pool-wide total (supply cap, TVL limit), compare it against the delta you intend to add, not the absolute target; otherwise existing position is subtracted twice and triggers spurious withdrawals.