# Withdrawal caps ignore committed assets

Does maxWithdraw/maxRedeem reserve assets backing open positions, settlements, and fees?

_Area: DeFi accounting and math bugs. Seen in 2 disclosed reports; latest 2026-03-09. Updated 2026-10-30._

## How it works
A vault or market computes how much a user may withdraw from a balance figure that does not represent free assets. The limit is derived from total or deposited assets, but some of those assets are already committed: backing open long positions, or reduced by a fee paid out of collateral. The cap therefore lets users pull liquidity that other obligations depend on. The broken assumption is that "assets on the books" equals "assets available to withdraw." A related shape: a preview path (share pricing, liquidation, max-withdraw) filters or ignores a commitment while the settlement path honors it, so the two disagree.

## Where it shows up
- `maxWithdraw`/`maxRedeem` computed as `depositedAssets - 1` or similar, with no reserve for open positions [E3](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-10.md)
- Tokens credited to a vault on position open but never marked reserved against close obligations [E3](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-10.md)
- Preview/accrual functions that apply a time window while the settle function does not [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-15.md)
- Accounting formulas that subtract a debt delta but omit a fee paid from collateral [E2](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AM-03.md)

## How to review
Identify every asset the contract holds and classify it as free or committed. Enumerate committed assets per position type: for each open position, the tokens needed to close or force-exercise it; for each pending settlement, the earnings it will credit; for each flashloan or fee path, the fee paid from collateral. The invariant: `maxWithdraw <= freeAssets`, where freeAssets excludes all of the above. Check that the preview path and the settlement path use the same accrual window and the same fee terms. For each formula that recomputes a position after a state change, confirm both sides of the balance sheet move by the same amount, including fees: when a fee is paid from collateral, verify the collateral delta equals the debt delta plus the fee [E2](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AM-03.md).

## Variants seen
- Time-window mismatch: `totalAssets()` excludes overdue earnings that `repayAtMaturity()` still credits [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-15.md)
- Fee omission: `newDeployedAmount` ignores the flashloan fee paid from collateral, overstating deployed capital [E2](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AM-03.md)
- Missing reserve: `maxWithdraw` reserves only 1 wei, not tokens backing longs [E3](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-10.md)

## Impact and severity
Medium in all three reports. Consequences: risk-free arbitrage, and bad debt after liquidation when the mispricing is large enough [E1](https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-15.md); understated management fees [E2](https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AM-03.md); and long holders temporarily unable to close or force-exercise while LPs hold the backing liquidity [E3](https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-10.md). Severity rises when the locked assets are needed for liquidation or close, since that turns a fee error into a solvency or liveness problem.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-04-interest-rate-model%3AM-15.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-05-bakerfi%3AM-03.md
- E3: https://bugbountylibrary.com/r/c4%3A2025-12-panoptic-next-core%3AM-10.md