# `_splitWithdrawRequest` will make invalid withdraw requests in an edge case

In _splitWithdrawRequest, deleting the from account's withdraw request zeroes the storage pointer, setting the liquidator's requestId to 0 and losing their vault shares.

- Payout: Contest reward
- Severity: high
- Program: Leveraged Vaults
- Credited: ZeroTrust
- Disclosed: 2024-06-18
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-06-leveraged-vaults-judging/issues/6
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:solidity technique:source-review vuln:accounting-error vuln:business-logic

**Target:** WithdrawRequestBase.sol _splitWithdrawRequest
**Root cause:** The storage pointer w references the from account's withdraw request; deleting that mapping entry resets w, so w.requestId becomes 0 before being copied to the liquidator's request.
**Steps:**
1. Account A has a pending withdraw request with requestId != 0 and vaultShares == X.
2. A is fully liquidated; _splitWithdrawRequest(A, liquidator, X) is called.
3. w = getAccountWithdrawRequest()[A]; w.vaultShares == vaultShares triggers `delete getAccountWithdrawRequest()[A]`.
4. The delete resets w.requestId to 0.
5. toWithdraw.requestId = w.requestId assigns 0 to the liquidator's request.
6. Finalize functions ignore requestId 0, so the liquidator's vault shares are lost.
**How found:** Code reading of _splitWithdrawRequest: noticed the storage pointer w is used after the delete of the same mapping slot, and confirmed with a Foundry test logging requestId before/after delete (non-zero -> 0).
**Exploitation:** Triggered automatically on every full liquidation: the liquidator receives a withdraw request with requestId 0, which cannot be finalized, locking the transferred vault shares.
**Insight:** When a storage pointer aliases a mapping entry, deleting the entry resets the pointer; copy needed fields to memory before any delete that targets the same slot.