# The withdrawValue calculation in _calculateValueOfWithdrawRequest is incorrect.

Withdraw request valuation used total withdrawal amount instead of user's share, overvaluing collateral and preventing liquidations in Notional leveraged vaults.

- Payout: Contest reward
- Severity: high
- Program: Leveraged Vaults
- Credited: ZeroTrust
- Disclosed: 2024-06-18
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-06-leveraged-vaults-judging/issues/78
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-12
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:sherlock sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic

**Target:** PendlePTEtherFiVault, PendlePTKelpVault, PendlePTStakedUSDeVault, EthenaVault
**Root cause:** _getValueOfWithdrawRequest implementations in PendlePTEtherFiVault, PendlePTKelpVault, PendlePTStakedUSDeVault, and EthenaVault return the value of the entire withdrawal request (tokenOutSY, expectedStETHAmount, userCooldown.underlyingAmount) instead of the portion corresponding to w.vaultShares, overvaluing split but unfinalized requests.
**Steps:**
1. User has a withdraw request that has been split but not finalized (hasSplit=true, s.finalized=false).
2. Call convertStrategyToUnderlying(account, vaultShares, maturity) on the affected vault.
3. It calls _calculateValueOfWithdrawRequest, which falls through to _getValueOfWithdrawRequest.
4. The override returns value based on total withdrawal amount, not w.vaultShares, inflating withdrawValue.
5. The inflated value is used in Notional's calculateAccountHealthFactors via getPrimaryUnderlyingValueOfShare.
6. Liquidation checks (e.g., deleverageAccount) see a healthier position than actual, preventing liquidation.
**How found:** Code review of _calculateValueOfWithdrawRequest and its overrides, noticing that _getValueOfWithdrawRequest in several vaults ignores w.vaultShares and uses total withdrawal amounts.
**Exploitation:** An attacker with a split but unfinalized withdraw request can make their position appear overcollateralized, avoiding liquidation and potentially withdrawing more than entitled, causing bad debt for the protocol.
**Escalation:** The incorrect valuation propagates to Notional V3's liquidation logic, affecting all vaults using the flawed overrides.
**Insight:** When auditing vault share valuation, verify that all branches of withdraw request valuation use the user's specific share amount (w.vaultShares) rather than total request amounts, especially for split requests.