<!-- canonical: https://0xsimao.com/findings/beraborrow-i-erc4626-exceeded-redeem-withdrawal -->

# Incorrect `ERC4626ExceededMaxRedeem` event on `ManagedLeveragedVault.sol:: cancelWithdrawalIntent()`

Low/Info · Sherlock · CDP stablecoin · 25th April, 2025

Finding L-3 of the Beraborrow Managed Dens security review.

- Protocol: https://www.beraborrow.com/
- Report: /reports/beraborrow-i
- Source: https://1570492309-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FffzDCMBDa391vIMqruBP%2Fuploads%2FUKDtjc6Dkn6P6i35j5H1%2FManaged%20Leverage%20Vaults%20v0%20private%20audit%20Sherlock.pdf?alt=media&token=c7304efa-8040-4ed0-9a98-dc949af28a85

---

## Summary

`ERC4626ExceededMaxRedeem` first argument is `owner`, but the code emits it with receiver.

## Vulnerability Detail

Full function:
```solidity
function cancelWithdrawalIntent(uint256 epoch, uint256 sharesToCancel, address receiver) external nonReentrant {
    /// @dev To be tested, but I think that between CUTOFF and CUTOFF - EPOCH (60 mins and 45 mins) before end, it can be canceled
    if (epoch < getWithdrawalRequestEpoch(block.timestamp)) revert CancelTooLate();

    ManagedLeveragedVaultStorage storage $ = _getManagedLeveragedVaultStorage();

    if ($.reports[epoch].reported) revert AlreadyReported();
    uint256 shares = $.reports[epoch].balanceOf[msg.sender];
    if (shares == 0) revert AmountZero();
    if (sharesToCancel > shares) revert ERC4626ExceededMaxRedeem(msg.sender, sharesToCancel, shares);

    $.reports[epoch].balanceOf[msg.sender] -= sharesToCancel;
    $.reports[epoch].totalShares -= sharesToCancel;

    _transfer(address(this), receiver, sharesToCancel);

    emit WithdrawalIntentCanceled(msg.sender, receiver, epoch, sharesToCancel);
}
```
It shows that `ERC4626ExceededMaxRedeem` is emitted with `msg.sender`, which is the `receiver`, not the `owner`.

## Impact

Incorrect event emission.

## Code Snippet

https://github.com/sherlock-audit/2025-04-beraborrow-vault-update/pull/1/files#diff-2d972f52027e0ba1065b2de2b424416244bfef9e2a79d2604e1687867f72c91eR331`

## Tool Used

Manual Review

## Recommendation

Use another event.

---

Related findings:

- [Incorrect initial deposit calculation may cause cancelProgram to revert](https://0xsimao.com/findings/superfluid-locker-system-ii-initial-deposit-program-revert): Superfluid Locker Pumponomics
- [`PreDepositVault::maxDeposit/Mint()` are missing `maxDepositLimit` as per the ERC4626 spec](https://0xsimao.com/findings/gaib-deposit-mint-erc4626-spec): GAIB Pre-Vaults
- [ERC4626YieldBackend.withdrawMax() silently succeeds when vault is paused, leaving funds stuck](https://0xsimao.com/findings/superfluid-erc4626-yield-paused-stuck): Superfluid Yield Backends
- [ERC4626YieldBackend does not support vaults with deposit/withdrawal fees or slashing](https://0xsimao.com/findings/superfluid-erc4626-yield-withdrawal-slashing): Superfluid Yield Backends