# Strategy liquidity assumed full on withdraw

Withdraw/valuation math assumes full strategy liquidity; check leftover amounts and actual tokens received before mutating shares

_Area: DeFi accounting and math bugs. Seen in 3 disclosed reports; latest 2022-02-14. Updated 2026-10-23._

## How it works
Withdraw and valuation code assumes a strategy can return the full requested amount. When the strategy holds only partial liquidity, the call returns less than requested (or zero) without reverting. The caller then updates share accounting as if the full amount moved: shares are burned, user entries deleted, or balances reduced, while the user received little or nothing. The invariant that must hold — tokens delivered equals shares burned at the stated rate — silently breaks.

## Where it shows up
- Withdraw loops that exit without checking the remaining `_amount` is zero [E1](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AH-04.md)
- Single-shot `unlockTokens`/strategy calls whose return value is ignored before accounting updates [E3](https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-07.md)
- `maxWithdraw`/reserve logic that reserves only a token amount (e.g. `deposited - 1 wei`) instead of obligations backing open positions [E2](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-10.md)
- Share burn or user-entry deletion performed before or regardless of actual tokens received [E1](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AH-04.md)[E3](https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-07.md)
- Valuation that reads strategy balance as if fully liquid

## How to review
Trace every withdraw/valuation path and confirm: (1) the actual tokens received are compared to the requested amount; (2) if less, the function reverts or scales the share burn to what was delivered; (3) loops revert on any leftover amount after exhausting vault/controller/strategy liquidity [E1](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AH-04.md); (4) reserve math accounts for tokens needed to satisfy future close/return obligations, not just a nominal 1 wei [E2](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-10.md); (5) accounting mutations happen only after reconciliation [E3](https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-07.md). The property: no state change may reduce a user's claim by more value than the tokens actually transferred out.

## Variants seen
- Silent partial/zero fill in a controller withdraw loop, shares burned for nothing [E1](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AH-04.md)
- LP withdrawal allowed to drain liquidity backing open long positions, locking holders [E2](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-10.md)
- `withdrawAll`/`switchStrategy` deleting user accounting on partial strategy liquidity, freezing funds [E3](https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-07.md)

## Impact and severity
Users lose shares or entries for no tokens [E1](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AH-04.md)[E3](https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-07.md); funds become frozen or positions unclosable [E2](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-10.md)[E3](https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-07.md). Severity is high where the loss is permanent or an attacker can starve liquidity just before a victim transaction to profit from share-price movement [E1](https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AH-04.md). Worse when accounting is deleted rather than left inconsistent, since recovery requires manual intervention [E3](https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-07.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2021-09-yaxis%3AH-04.md
- E2: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-10.md
- E3: https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-07.md