# External lending can exceed the threshold

Notional's max external lend formula ignores that deposits raise pool liquidity, letting lending exceed the externalWithdrawThreshold and risking withdrawal/liquidation liquidity shortfalls.

- Payout: Contest reward
- Severity: medium
- Program: Notional Update 5
- Credited: xiaoming90
- Disclosed: 2023-12-20
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-12-notional-update-5-judging/issues/38
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-notional-update-5%3AM-7
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic

**Target:** ExternalLending.getTargetExternalLendingAmount (Aave external lending rebalancing)
**Root cause:** maxExternalUnderlyingLend is computed as (availableForWithdraw - currentLend) * PERCENTAGE_DECIMALS / threshold, but depositing increases both availableForWithdraw and currentLend, so the post-deposit ratio L/W exceeds the intended threshold.
**Steps:**
1. Set externalWithdrawThreshold=200%, so PERCENTAGE_DECIMALS/threshold = 0.5.
2. Observe externalUnderlyingAvailableForWithdraw=1000 USDC, currentExternalUnderlyingLend=400 USDC.
3. Compute maxExternalUnderlyingLend = (1000-400)*0.5 = 300 USDC.
4. Lend 300 USDC: currentLend becomes 700, availableForWithdraw becomes 1300.
5. Ratio 700/1300 = 0.538 > 0.5, violating the 200% threshold invariant.
**How found:** Code-reading of the maxExternalUnderlyingLend formula against the documented externalWithdrawThreshold invariant; noticed deposits increase pool liquidity, so using current pool liquidity to size the deposit breaks the ratio.
**Insight:** When a cap is expressed as a ratio of your position to total pool liquidity, remember your own deposit inflates the denominator; solve the fixed-point equation D=(TW-L)/(1-T) rather than using the pre-deposit difference.