# BatchOut:withdrawFulfill() can be DoSed by spamming withdrawal requests, leading to OOG reverts Crit/High · Three Sigma · DeFi infrastructure · 10th November, 2023 Finding 3S-Clip Finance-H04 of the Clip Finance Strategies security review. - Protocol: https://www.clip.finance/ - Report: /reports/clip-finance-i - Source: https://cdn.sanity.io/files/qoqld077/production/c23d04c8223879d2443221caf3ccb55ac118441a.pdf --- ### Description Anyone can schedule as many withdrawals as they want in BatchOut:scheduleWithdraw(), specifying little shares to different withdrawTo addresses. Then, in withdrawFulfill(), it will loop over all the requests in the cycle, leading to OOG reverts if enough requests were spammed. ### Recommendation Send as argument a number of requests to fulfill, so the OOG revert can be prevented. ### Status Addressed in [#4dc4687](https://github.com/ClipFinance/StrategyRouter-private/commit/4dc4687dcc6c6a4c475684ccbeba249224359125#diff-fc7a02534f1f5e1f0391984309f5086fe52a645caa6a467c499f16e0df252ac5R465) --- Related findings: - [Typo in fufillWithdrawal() in glAVAX, should be fulfillWithdrawal](https://0xsimao.com/findings/glacier-typo-fufill-withdrawal-fulfill): Glacier - [CEI pattern is not followed on LoopedVault::fulfillWithdraw()](https://0xsimao.com/findings/yieldoor-iii-cei-followed-fulfill-withdraw): Yieldoor LoopedVault Update - [Attackers can DoS redemptions by cancelling requests just before the batch is processed](https://0xsimao.com/findings/maple-finance-iii-redemptions-cancelling-requests-processed): Maple Withdrawal Queue - [DoSed `Voter::finalize()` due to unbounded pending removals lacking a batch argument variable](https://0xsimao.com/findings/bmx-voter-unbounded-removals-lacking): BMX