# Premature collateralization check in the BaseStakingVault.initiateWithdraw() function can leave accounts undercollateralized

BaseStakingVault.initiateWithdraw checks collateralization before unwrapping tokens into the withdrawal queue, so accounts can end up undercollateralized after the check passes.

- Payout: Contest reward
- Severity: medium
- Program: Leveraged Vaults
- Credited: eeyore
- Disclosed: 2024-06-18
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2024-06-leveraged-vaults-judging/issues/56
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AM-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:liquidation

**Target:** BaseStakingVault.initiateWithdraw() in Notional leveraged-vaults staking vaults
**Root cause:** The collateralization check via NOTIONAL.getVaultAccountHealthFactors runs before _initiateWithdraw(), which unwraps tokens and pushes them into the withdrawal queue, changing the underlying asset used for valuation.
**Steps:**
1. Call `initiateWithdraw()` on BaseStakingVault.
2. Observe health factors are read before `_initiateWithdraw()` executes.
3. `_initiateWithdraw()` unwraps tokens (e.g. rsETH -> stETH) and queues them, changing the collateral asset valuation.
4. If the new asset price is lower relative to the old, the account's collateral ratio drops below minCollateralRatio after the check already passed.
**How found:** Code review of initiateWithdraw ordering; noticed the check precedes the state-changing call, contradicting Notional core contracts which always check collateralization as the final step.
**Exploitation:** A user initiates a withdrawal while the vault's shares are valued on the pre-unwrap asset (e.g. rsETH); after the unwrap the valuation switches to a cheaper asset (e.g. stETH), leaving the position undercollateralized/insolvent for the user and protocol.
**Insight:** When auditing vault/withdrawal flows, verify solvency checks run after all asset-transforming operations; unwrapping or queueing can silently swap the valuation asset and invalidate a pre-action health check.