# Inconsistent batch:rebalance() behavior when some strategies reach their limit, leading to yield loss Crit/High · Three Sigma · DeFi infrastructure · 10th November, 2023 Finding 3S-Clip Finance-M05 of the Clip Finance Strategies security review. - Protocol: https://www.clip.finance/ - Report: /reports/clip-finance-i - Source: https://cdn.sanity.io/files/qoqld077/production/c23d04c8223879d2443221caf3ccb55ac118441a.pdf --- ### Description Strategies are allocated funds pro-rata to their weights. However, when the target of a strategy is reached, it won't be allocated any more funds. The funds that were supposed to be allocated to a strategy but its limit was reached, will be allocated to other strategies if they are after it in the array https://github.com/ClipFinance/strategy-router/blob/master/contracts/Batch.sol#L335.However, if the strategies that haven't reached their limit are before the strategy whose limit was reached in the array, the extra funds will be allocated to idle strategies instead https://github.com/ClipFinance/strategy-router/blob/master/contracts/Batch.sol#L288.This is because when a strategy reaches its limit, the weight is set to 0, and the total batch unallocated tokens are not decreased. This means that if the strategy is first, the other strategies will acquire the extra unallocated tokens. But if the strategy is last, the tokens won't be allocated and will be sent to idle strategies instead. ### Recommendation Cap the weight of a strategy to the amount required for the strategy to reach its limit, before allocating any funds. Note: rebalanceStrategies() ignores the capacity data, which means that it would likely surpass the limit if called afterwards. ### Status Addressed in [#687172d](http://clipfinance/StrategyRouter-private@687172d#diff-403f5ba51e49b6bbbf3d306515cfc95acb8ab10e176367c18ff2cea68229969cR29) --- Related findings: - [Aave rounding behavior allows malicious users to drain accumulated yield via small withdrawals](https://0xsimao.com/findings/superfluid-aave-rounding-drain-yield): Superfluid Yield Backends - [reduceOnly limit order update does not take into account that a new amm may be selected, which may lead to loss of funds](https://0xsimao.com/findings/nftperp-i-reduce-account-amm-selected): Nftperp Exchange - [Frozen/paused Market that is harvested from in StakedEXA will DoS deposits leading to loss of yield](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-paused-harvested-deposits-yield): Exactly Protocol Update - Staking Contract