# Anyone can grief users, stopping them from fulfilling their withdrawals Crit/High · Three Sigma · DeFi infrastructure · 10th November, 2023 Finding 3S-Clip Finance-H01 of the Clip Finance Strategies security review. - Protocol: https://www.clip.finance/ - Report: /reports/clip-finance-i - Source: https://cdn.sanity.io/files/qoqld077/production/c23d04c8223879d2443221caf3ccb55ac118441a.pdf --- ### Description On the Batch.sol contract, anyone can call [withdrawFulfill()](https://github.com/ClipFinance/strategy-router/blob/master/contracts/BatchOut.sol#L326) with the current cycle id, incrementing the cycleInfo[currentCycleID].withdrawRequestsFullFilled and setting the userWithdrawStorage[cycleID][userAddress].withdrawStatus to true, without sending any tokens to the users, since the currentCycle.tokensWithdrawn.token will have a length of zero, so the loop will constantly skip iterations at this [continue](https://github.com/ClipFinance/strategy-router/blob/master/contracts/BatchOut.sol#L357). When someone inevitably calls executeBatchWithdrawFromStrategyWithSwap() and then withdrawFulfill(), the loop will start with the offset cycleInfo[currentCycleID].withdrawRequestsFullFilled and some users will have the userWithdrawStorage[cycleID][userAddress].withdrawStatus flag set to true, so they will be skipped and will never be able to receive the tokens from their shares. This issue is also problematic because, if later but still in the same cycle, the same users try to add shares, they will be added to the previous request (which will always be skipped by the withdrawFulfill()), so they will also lose these extra shares. ### Recommendation Add require(cycleID < currentCycleId); at the start of withdrawFulfill(). ### Status Addressed in [#04bd247](https://github.com/ClipFinance/StrategyRouter-private/commit/04bd2479c756a537bacb1da09f53a3f7b6c74423) --- Related findings: - [User may be requesting/fulfilling withdrawals at better rates than the real share/asset ratio](https://0xsimao.com/findings/yieldoor-iii-requesting-fulfilling-withdrawals-share): Yieldoor LoopedVault Update - [`LidoVault::vaultEndedWithdraw` doesn't take into consideration income withdrawals before slashing, blocking variable users from withdrwing their income](https://0xsimao.com/findings/saffron-lido-vaults-withdraw-withdrawals-slashing-withdrwing): Saffron Lido Vaults - [Connext delegates can perform important actions, make sure smart contract users implement them](https://0xsimao.com/findings/fuji-finance-perform-important-actions-sure): Fuji Finance - [Users buying too many tickets will DoS them and the protocol if they are the winner due to OOG](https://0xsimao.com/findings/winnables-raffles-buying-tickets-winner-oog): Winnables Raffles