# After a liquidator liquidates someone else’s position, it could cause a Denial of Service (DoS) when their own position also needs to be liquidated.

Liquidator who acquires extra vaultShares beyond their withdraw request underflows in _splitWithdrawRequest, blocking their own future liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Leveraged Vaults
- Credited: ZeroTrust
- Disclosed: 2024-06-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-leveraged-vaults-judging/issues/44
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AM-2
- Tags: domain:web3 impact:dos kind:contest platform:sherlock sev:medium tech:solidity technique:source-review vuln:business-logic vuln:dos vuln:liquidation

**Target:** WithdrawRequestBase._splitWithdrawRequest in leveraged vaults
**Root cause:** When a liquidator receives vaultShares from liquidating another position, their account vaultShares can exceed their withdrawRequest.vaultShares. Later liquidation calls _splitWithdrawRequest with vaultShares > w.vaultShares, so `w.vaultShares - vaultShares` underflows and reverts.
**Steps:**
1. Liquidator holds 10e8 vaultShares with withdrawRequest.vaultShares = 1e8.
2. Liquidator liquidates a user with 1e8 vaultShares; _splitWithdrawRequest transfers 1e8 shares, leaving liquidator with 11e8 vaultShares but withdrawRequest.vaultShares still 1e8.
3. Later liquidator's own position becomes unhealthy; Notional computes vaultSharesFromLiquidation = 2e8.
4. Liquidation calls _splitWithdrawRequest with vaultShares=2e8 > w.vaultShares=1e8, so `w.vaultShares = w.vaultShares - vaultShares` reverts.
5. Liquidator's position cannot be liquidated.
**How found:** Code reading of _splitWithdrawRequest revealed the assumption that requested withdraw vaultShares always >= vaultSharesFromLiquidation; the researcher noted this fails for liquidators who accumulate shares from liquidations.
**Exploitation:** No attacker action required; the state arises naturally when a liquidator liquidates another position and later becomes liquidatable themselves. The revert blocks the liquidation call, leaving bad debt.
**Insight:** In liquidation/split accounting, check whether an account's share balance can grow independently of its withdraw request (e.g. via receiving shares from others' liquidations); subtraction-based splits then underflow. Look for implicit invariants like 'request >= balance' that external flows can break.