# Requested withdrawal can be impossible to settle due to EigenLayer shares value appreciate when there are idle funds in deposit pool

Withdrawal requests record EigenLayer shares at request time; if share value appreciates while funds idle in the deposit pool, the epoch cannot be settled, blocking all withdrawals.

- Payout: Contest reward
- Severity: high
- Program: Rio Network Core Protocol
- Credited: g
- Disclosed: 2024-02-14
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-02-rio-network-core-protocol-judging/issues/109
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-02-rio-network-core-protocol%3AH-6
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:dos

**Target:** RioLRTCoordinator requestWithdrawal/rebalance settlement flow
**Root cause:** Withdrawal requests cache EigenLayer share amounts at request time, but settlement later converts assets to shares at a higher appreciated rate, so the queued share count exceeds available shares and rebalance reverts with INCORRECT_NUMBER_OF_SHARES_QUEUED.
**Steps:**
1. Deposit 5e18 cbETH and rebalance so shares are delegated to EigenLayer.
2. Deposit 100e18 cbETH into the deposit pool (idle, not rebalanced).
3. Call `requestWithdrawal(CBETH_ADDRESS, 100e18)` recording 100 EigenLayer-cbETH shares owed.
4. Increase EigenLayer-cbETH share value (e.g. donate cbETH to the strategy) so 1 share = 1.1 cbETH.
5. Advance `rebalanceDelay()` and call `rebalance(CBETH_ADDRESS)`; it reverts with `INCORRECT_NUMBER_OF_SHARES_QUEUED()` because only ~95.9 shares exist for a 100-share obligation.
**How found:** Reasoned that withdrawal requests snapshot share amounts while settlement converts at current rate; noticed idle deposit-pool funds are not yet delegated, so appreciation of EigenLayer shares creates a share shortfall.
**Exploitation:** An attacker (or any user) deposits into the idle deposit pool and requests withdrawal, then share value appreciation (via donation to the strategy or natural yield) makes the recorded share obligation exceed total shares, permanently blocking epoch settlement and freezing all pending withdrawals.
**Escalation:** Blocking one epoch stalls the entire withdrawal queue, affecting all subsequent withdrawals.
**Insight:** When a protocol snapshots share/asset conversions at request time but settles at a later rate, check whether idle (undelegated) funds break the invariant that recorded shares <= available shares; ERC4626-style appreciating shares make this drift exploitable.