# Withdrawal ignores external limits or liquidity

Withdraw/redeem paths that skip external protocol min/max bounds or derive limits from current positions

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2024-06-18. Updated 2026-10-29._

## How it works
A withdraw or redeem path assumes it can always move the full requested amount. It either (a) calls an external protocol without honoring that protocol's documented input bounds (min/max amounts, pause states), or (b) computes how much can be withdrawn from the wrong quantity, such as the current opened position rather than the target allocation. When the assumption breaks, the call reverts or the limit collapses to near zero, and funds that should be redeemable are stuck.

## Where it shows up
- A withdraw path that calls an external protocol's request/queue function with a user-supplied or computed amount and no clamp to that protocol's MIN/MAX constants [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-2.md)
- Cooldown or two-step flows (initiate then trigger) where the bound check is missing in the initiation step, so the failure surfaces later and blocks the whole flow [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-2.md)
- `maxRedeem`/`maxWithdraw` derived from current position size in each underlying market instead of target-vs-current comparison [E2](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AH-3.md)
- A single market pinned at a cap (maker limit) with a tiny position throttling global redemption [E2](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AH-3.md)
- Wrapper contracts that aggregate many users under one on-chain identity, where a downstream transfer requires the full balance [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-22.md)

## How to review
For every external call in a withdraw path, enumerate the callee's documented input bounds and confirm the integration enforces them before entering a stateful flow. For limit math, check the invariant: the redeemable amount must be a function of the user's claim and available liquidity, not of an unrelated current position that can be pinned at a cap. For wrappers, verify that partial-share redemption does not require the caller to hold the entire aggregated balance [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-22.md).

## Variants seen
- Missing external min/max enforcement on a Lido withdrawal, bricking whale withdrawals [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-2.md)
- Redeem limit derived from smallest current market position, collapsing max redeem despite huge TVL [E2](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AH-3.md)
- Shared lender identity causing partial redemption to revert with NoAllowance [E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-22.md)

## Impact and severity
Funds permanently locked or withdrawals effectively disabled [E1](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-2.md)[E2](https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AH-3.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-22.md). Severity is high when the failure is permanent (locked funds) and worse when it affects large depositors or the whole vault, since a single pinned market or one oversized request throttles everyone.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-2.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-10-perennial%3AH-3.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2023-01-ajna%3AM-22.md