# Lido withdraw limitation will brick the withdraw process in an edge case

Kelp vault withdraw calls Lido requestWithdrawals without enforcing MIN/MAX stETH limits, so whale withdrawals >1000 ETH revert in triggerExtraStep, permanently locking funds.

- Payout: Contest reward
- Severity: high
- Program: Leveraged Vaults
- Credited: novaman33
- Disclosed: 2024-06-18
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-06-leveraged-vaults-judging/issues/14
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-2
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:dos

**Target:** Kelp.sol _initiateWithdrawImpl / triggerExtraStep
**Root cause:** The vault initiates a Lido withdrawal without checking Lido's MIN_STETH_WITHDRAWAL_AMOUNT and MAX_STETH_WITHDRAWAL_AMOUNT bounds, so amounts outside those bounds cause requestWithdrawals to revert.
**Steps:**
1. User with stETH share > MAX_STETH_WITHDRAWAL_AMOUNT (1000 ETH) calls `initiateWithdraw` on BaseStakingVault.
2. `_initiateWithdrawImpl` in Kelp.sol creates a holder contract, transfers rsETH, and calls `holder.startCooldown`.
3. After cooldown, user calls `triggerExtraStep`, which pulls stETH from Kelp and calls `LidoWithdraw.requestWithdrawals(amounts, address(this))`.
4. Lido reverts because amount exceeds MAX_STETH_WITHDRAWAL_AMOUNT; `triggerExtraStep` always reverts and stETH remains stuck in Kelp.
**How found:** Researcher read Lido's documented requestWithdrawals limitations and compared them to Kelp.sol's _initiateWithdrawImpl and triggerExtraStep, noticing no enforcement of MIN/MAX withdrawal amounts.
**Exploitation:** A whale depositor with >1000 ETH initiates a withdrawal; the pending withdraw request cannot be finalized because triggerExtraStep always reverts, locking the stETH in Kelp and preventing further deposits or liquidations.
**Insight:** When integrating external protocols, enumerate their documented input bounds (min/max amounts, pause states) and verify the integration enforces them before initiating stateful flows like cooldowns.