# Batch:withdraw() can be DoSed by frontrunning it with strategyRouter:allocateToStrategies() Medium · Three Sigma · DeFi infrastructure · 10th November, 2023 Finding 3S-Clip Finance-M04 of the Clip Finance Strategies security review. - Protocol: https://www.clip.finance/ - Report: /reports/clip-finance-i - Source: https://cdn.sanity.io/files/qoqld077/production/c23d04c8223879d2443221caf3ccb55ac118441a.pdf --- ### Description Anyone who wants to withdraw from a batch via Batch:withdraw() can be frontrunned by an allocateToStrategies() call, which increases the cycle id, making the withdrawal [revert](https://github.com/ClipFinance/strategy-router/blob/master/contracts/Batch.sol#L214). This not only DoS users, but also places them at a loss if they want to withdraw, as they will likely receive shares worth [less](https://github.com/ClipFinance/strategy-router/blob/master/contracts/StrategyRouterLib.sol#L286-L288) than their deposits at the moment the allocation happens. ### Recommendation Make strategyRouter:allocateToStrategies() permissioned so it becomes impossible for malicious users to perform the attack. Additionally, it's probably better to set some sort of fixed interval for the allocations to happen, so users have time to withdraw if they want to. ### Status Acknowledged --- Related findings: - [An attacker may DoS user Fluid balance increases by frontrunning `FluidLocker::claim()` calls and calling `EP_PROGRAM_MANAGER::batchUpdateUserUnits()` directly](https://0xsimao.com/findings/superfluid-locker-system-increases-frontrunning-program-directly): Superfluid Locker System - [Strategy withdraw may fail if weights of strategies differ from the real values and might lead to frozen ReservePool](https://0xsimao.com/findings/glacier-withdraw-weights-differ-real): Glacier - [Strategies in the ReservePool could be implemented as an array and Strategy packed](https://0xsimao.com/findings/glacier-strategies-implemented-array-packed): Glacier - [DoSed `Voter::finalize()` due to unbounded pending removals lacking a batch argument variable](https://0xsimao.com/findings/bmx-voter-unbounded-removals-lacking): BMX