# Halted withdrawals in BatchOut due to setting withdrawTo to address(0) in scheduleWithdrawal() Crit/High · Three Sigma · DeFi infrastructure · 10th November, 2023 Finding 3S-Clip Finance-H06 of the Clip Finance Strategies security review. - Protocol: https://www.clip.finance/ - Report: /reports/clip-finance-i - Source: https://cdn.sanity.io/files/qoqld077/production/c23d04c8223879d2443221caf3ccb55ac118441a.pdf --- ### Description BatchOut:scheduleWithdraw() allows sending a withdrawTo argument of 0. Some tokens, such as [USDT](https://bscscan.com/address/0x55d398326f99059ff775485246999027b3197955#code), revert when transferring tokens to address 0. This means that, when fulfilling withdrawals, the loop will be DoSed when it reaches the 0 address withdrawal, halting all withdrawals in the cycle. ### Recommendation Do not allow 0 address withdrawTo. ### Status Addressed in [#4dc4687](https://github.com/ClipFinance/StrategyRouter-private/commit/4dc4687dcc6c6a4c475684ccbeba249224359125#diff-fc7a02534f1f5e1f0391984309f5086fe52a645caa6a467c499f16e0df252ac5R115) --- Related findings: - [Pool Delegates can steal all the pool's funds by setting a malicious Withdrawal Manager.](https://0xsimao.com/findings/maple-finance-iii-delegates-steal-setting-withdrawal): Maple Finance - [Limitations for Users Employing Multi-sig or Account Abstraction Wallets in Setting Delegate Address](https://0xsimao.com/findings/ostium-limitations-employing-abstraction-delegate): Ostium - [`ManagedLeveragedVault::executeWithdrawalEpoch()` incorrect ICR and DoSed withdrawals due to not accouting for fees](https://0xsimao.com/findings/beraborrow-i-withdrawal-epoch-withdrawals-fees): Beraborrow Managed Dens - [DoSed withdrawals due to `ManagedLeveragedVault::executeWithdrawalEpoch()` repaying debt above limit](https://0xsimao.com/findings/beraborrow-i-withdrawals-withdrawal-epoch-debt): Beraborrow Managed Dens