# `tower.gameETHForWithdraw` should be reduced pro-rata when there is not enough `ETH` Crit/High · Three Sigma · DeFi game · 23rd October, 2024 Finding H-3 of the CODEUP security review. - Report: /reports/codeup - Source: https://cdn.sanity.io/files/qoqld077/staging/d9e57830a75b5165fd56e8b88037de7986a165ec.pdf --- ### Description `Codeup::withdraw()` and `Codeup::reinvest()` cap the withdrawn amount to the available `ETH` balance, but always set the `tower.gameETHForWithdraw` to `0`, which means that a user can have a significant amont of `gameETH` for withdraw, but due to the contract having low `ETH` balance, most of these funds could be lost. This is relevant because blockchains often have concurrency issues, which means, for example, 2 users trying to withdraw more than the contract balance at the same time could lead to one of them getting much less `ETH` than expected. ### Recommendation When there is not enough `ETH`,`tower.gameETHForWithdraw` should be reduced by the `amount` before subtracting the commission divided by the price, rounded up. --- Related findings: - [`totalCdsDepositedAmountWithOptionFees` is incorrectly reduced in `CDSLib::withdrawUser()`, leading to stuck option fees](https://0xsimao.com/findings/autonomint-fees-reduced-withdraw-stuck): Autonomint - [Users cannot unstake from YiedlETHStakingEtherfi.sol, because YieldAccount.sol is incompatible with ether.fi's WithdrawRequestNFT.sol](https://0xsimao.com/findings/benddao-unstake-eth-staking-yield): BendDAO - [Withdrawing after a slash event before the vault has ended will decrease `fixedSidestETHOnStartCapacity` by less than it should, so following users will withdraw more their initial deposit](https://0xsimao.com/findings/saffron-lido-vaults-slash-eth-withdraw-deposit): Saffron Lido Vaults