# Yield loss due to StrategyRouterLib:rebalanceStrategies() not allocating saturated strategy deposits Crit/High · Three Sigma · DeFi infrastructure · 10th November, 2023 Finding 3S-Clip Finance-H07 of the Clip Finance Strategies security review. - Protocol: https://www.clip.finance/ - Report: /reports/clip-finance-i - Source: https://cdn.sanity.io/files/qoqld077/production/c23d04c8223879d2443221caf3ccb55ac118441a.pdf --- ### Description StrategyRouterLib:rebalanceStrategies() withdraws excess funds from strategies and adds it up to the router balance. When strategies have less funds than desired, it first stores in [strategyDatas[i].toDeposit](https://github.com/ClipFinance/strategy-router/blob/master/contracts/StrategyRouterLib.sol#L574) the amount to be deposited. As can be seen in the previous code link, the strategy was not completely saturated, so the weight is bigger than 0, the funds were sent to the strategy, but deposit() was not called yet. Then, if the remaining weight of the strategy is [less than ALLOCATION_THRESHOLD](https://github.com/ClipFinance/strategy-router/blob/master/contracts/StrategyRouterLib.sol#L603), it skips the current strategy, never depositing the previous saturated weight. If it is bigger than ALLOCATION_THRESHOLD, it still skips the deposit of the previously saturated weight, due to the fact that it overrides strategyDatas[i].toDeposit [(L639](https://github.com/ClipFinance/strategy-router/blob/master/contracts/StrategyRouterLib.sol#L639), [L662](https://github.com/ClipFinance/strategy-router/blob/master/contracts/StrategyRouterLib.sol#L662) and [L684](https://github.com/ClipFinance/strategy-router/blob/master/contracts/StrategyRouterLib.sol#L684)). Thus, when it calls [`strategy.deposit()`](https://github.com/ClipFinance/strategy-router/blob/master/contracts/StrategyRouterLib.sol#L698), it only sends the value of the last swap, without taking into account the previously accumulated strategyDatas[i].toDeposit values. ### Recommendation Change strategyDatas[i].toDeposit = received; to strategyDatas[i].toDeposit += received; in L639, L662 and L684. Also, when the remaining weight of the strategy equals less than `ALLOCATION_THRESHOLD`, deposit strategyDatas[i].toDeposit before continuing. ### Status Addressed in [#ed8e3c9](https://github.com/ClipFinance/StrategyRouter-private/commit/ed8e3c994f013eb9af523201ff97df5f43e34baf) --- Related findings: - [Frozen/paused Market that is harvested from in StakedEXA will DoS deposits leading to loss of yield](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-paused-harvested-deposits-yield): Exactly Protocol Update - Staking Contract - [`CDSLib::calculateCumulativeRate()` incorrectly only increment the local option fees when there are cds deposits](https://0xsimao.com/findings/autonomint-increment-local-fees-deposits): Autonomint - [Strategies in the ReservePool could be implemented as an array and Strategy packed](https://0xsimao.com/findings/glacier-strategies-implemented-array-packed): Glacier - [Strategy withdraw may fail if weights of strategies differ from the real values and might lead to frozen ReservePool](https://0xsimao.com/findings/glacier-withdraw-weights-differ-real): Glacier