# DoSed StrategyRouter:withdrawFromStrategies() if strategyTokenBalancesUsd[i] is too small in the swapping phase Medium · Three Sigma · DeFi infrastructure · 10th November, 2023 Finding 3S-Clip Finance-M02 of the Clip Finance Strategies security review. - Protocol: https://www.clip.finance/ - Report: /reports/clip-finance-i - Source: https://cdn.sanity.io/files/qoqld077/production/c23d04c8223879d2443221caf3ccb55ac118441a.pdf --- ### Description StrategyRouter:withdrawFromStrategies() withdraws from the idle strategy of the withdraw token and then tries to withdraw from idle strategies and later strategies with other tokens. It tries to swap from idle strategies and strategies if there is still not enough usd, skipping the swap if [idleStrategyTokenBalancesUsd](https://github.com/ClipFinance/strategy-router/blob/master/contracts/StrategyRouter.sol#L755-L757) or [strategyTokenBalancesUsd](https://github.com/ClipFinance/strategy-router/blob/master/contracts/StrategyRouter.sol#L796-L798) are 0. However, when the balance is very small, it will likely be swapped into a 0 amount due to slippage, making it [revert](https://github.com/ClipFinance/strategy-router/blob/master/contracts/exchange/Exchange.sol#L138). This can be exploited by griefers by sending 1 amount to an idle strategy so it reverts. ### Recommendation Define a threshold to swap, similarly to the allocation threshold. ### Status Addressed in [#687172d](https://github.com/ClipFinance/StrategyRouter-private/commit/687172d53fe10cb5f0e8d8761f67238270e33415) --- Related findings: - [Strategy withdraw may fail if weights of strategies differ from the real values and might lead to frozen ReservePool](https://0xsimao.com/findings/glacier-withdraw-weights-differ-real): Glacier - [Strategies in the ReservePool could be implemented as an array and Strategy packed](https://0xsimao.com/findings/glacier-strategies-implemented-array-packed): Glacier - [Aave and SavingsUsds strategies may revert when trying to withdraw all funds](https://0xsimao.com/findings/maple-finance-iv-aave-revert-trying-withdraw): Maple Cash Strategies - [Withdraw and borrow can be DoSed in BaseRouter](https://0xsimao.com/findings/fuji-finance-withdraw-borrow-sed-base): Fuji Finance