# Withdraw assumes full liquidity available

Withdrawals, harvests, or redemptions that assume the full balance is liquid when funds are lent out or utilized

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2026-08-20. Updated 2026-10-29._

## How it works
A contract treats a balance as if it were cash. In lending markets, a supplier's balance (aToken, cToken, market shares) includes funds that are lent out. When utilization is high, only a fraction is actually withdrawable. Code that withdraws, harvests, or redeems the full amount, or that selects a source by comparing against total balance, will revert once the market is near full utilization. The broken assumption is "balance == available liquidity."

## Where it shows up
- Harvest or reward-update paths that pull assets from a lending market or strategy on deposit or claim [E1](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-5.md)
- Source/farm selection loops comparing an amount against `assets()` or a token balance instead of `liquidity()` or available cash [E2](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.19.md)
- Reserve or fee views that assume `total_borrow <= total_supply` and revert otherwise [E3](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-18.md)
- Any withdrawal with no cap to non-borrowed liquidity, or no fallback when a source is short

## How to review
Identify every place a balance is read before a withdrawal. The invariant: the amount withdrawn from a source must be bounded by that source's actual withdrawable liquidity, not its total balance. Check that harvest/redeem paths cap to available liquidity or skip/partially draw from short sources. Check that selection logic uses a liquidity getter (e.g. `liquidity()`) rather than `assets()`/balance [E2](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.19.md). Check that accounting paths agree on whether debt can exceed supply: if one path treats `debt >= supply` as valid, others must not revert on it [E3](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-18.md).

## Variants seen
- Harvest-on-deposit pulls from a near-100%-utilized market and reverts, DoSing new deposits [E1](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-5.md)
- Redemption picks a farm by total balance, then reverts because funds are utilized [E2](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.19.md)
- Reserve/fee collection reverts when accrued debt outgrows supplier supply under high utilization [E3](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-18.md)

## Why fixes fail
E3 shows the deeper issue: the interest-rate path already models `debt >= supply` as a valid high-utilization state, but the reserve path still treats it as an error. Fixing only the withdrawal cap leaves the accounting inconsistency.

## Impact and severity
Medium to high. Effects: deposits or redemptions blocked (DoS) [E1](https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-5.md)[E2](https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.19.md), protocol fee collection bricked [E3](https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-18.md). Worse when the failure is on a common path (deposit, redeem) and when utilization can naturally reach 100% through normal borrowing and interest compounding.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-07-exactly-stacking-contracts%3AM-5.md
- E2: https://bugbountylibrary.com/r/cantina%3Ainfinifi_april2025%3A3.2.19.md
- E3: https://bugbountylibrary.com/r/c4%3A2026-04-k2%3AM-18.md