# BatchOut:executeBatchWithdrawFromStrategyWithSwap() gives unfairly different slippage depending on the chosen token Crit/High · Three Sigma · DeFi infrastructure · 10th November, 2023 Finding 3S-Clip Finance-H03 of the Clip Finance Strategies security review. - Protocol: https://www.clip.finance/ - Report: /reports/clip-finance-i - Source: https://cdn.sanity.io/files/qoqld077/production/c23d04c8223879d2443221caf3ccb55ac118441a.pdf --- ### Description BatchOut:executeBatchWithdrawFromStrategyWithSwap() calls strategyRouter:withdrawFromStrategies() with the token having the [most requests](https://github.com/ClipFinance/strategy-router/blob/master/contracts/BatchOut.sol#L197) shares. This call will keep the assets/shares ratio, as it burns a number of shares according to the assets in strategyRouter:calculateSharesUsdValue(). However, the tokens actually withdrawn could be significantly less than the ideal corresponding to the shares. After withdrawing, it loops through the other tokens and calculates the ideal usd value from their requested shares. This means that only the token with the max shares that was used to withdraw is taking the slippage, while the others are still getting their maximum usd value (slightly less as they will be swapped, incurring extra slippage). Thus, users that chose to withdraw in the most requested token will likely incur significantly more slippage than the other tokens. The opposite scenario might also happen, if the withdrawToken has enough balance without going through swaps in router.withdrawFromStrategies(), then the slippage is taken only on the other tokens. ### Recommendation Consider creating cycles only of a certain withdrawal token, so users are under the same slippage. Else, a function could be created that handles withdrawals in several tokens, but this would take a much bigger effort. ### Status Acknowledged --- Related findings: - [Usdc to Usds calculation in the Sky Strategy is slightly different than the Psm Usds Wrapper](https://0xsimao.com/findings/maple-finance-iv-usdc-usds-slightly-wrapper): Maple Cash Strategies - [Swap amount can be 0 as it divides the balance by 2, DoSing ShadowStrategyGauge::collectGaugeRewards()](https://0xsimao.com/findings/yieldoor-i-divides-sing-shadow-rewards): Yieldoor Gauges - [The basic strategy does not have slippage control when withdrawing which may lead to arbitrage](https://0xsimao.com/findings/maple-finance-iv-slippage-control-withdrawing-arbitrage): Maple Cash Strategies - [`VaultV2::withdraw/redeem()` are vulnerable to slippage, so another function could be added to protect users](https://0xsimao.com/findings/morpho-vault-v2-withdraw-redeem-slippage-protect): Morpho Vault V2