# TokenVault allows withdrawals using offchain logic, so the offchain service must take into consideration reorgs Low/Info · Three Sigma · Social money games · 13th June, 2024 Finding 3S-D1-N05 of the DistrictOne security review. - Protocol: https://districtone.io/ - Report: /reports/districtone - Source: https://cdn.sanity.io/files/qoqld077/production/fd2142f1d189dd29db23dff49d4018d4da9c01d6.pdf --- ### Description TokenVault does not track or set the withdrawal logic on chain, so care must be taken in the offchain components due to reorgs. If users deposit and are awarded a withdrawal in a short time frame, a reorg could happen which ends up removing the deposit, but the user still has the withdrawal signature. ### Recommendation The fix is in the offchain component, which is making sure there is a delay between a deposit and the ability of a user to withdraw. The protocol is going to be deployed on Blast, which is unlikely to have reorgs, but it is still a good practice. ### Status Acknowledged --- Related findings: - [`LidoVault::vaultEndedWithdraw` doesn't take into consideration income withdrawals before slashing, blocking variable users from withdrwing their income](https://0xsimao.com/findings/saffron-lido-vaults-withdraw-withdrawals-slashing-withdrwing): Saffron Lido Vaults - [Withdrawals logic allows MEV exploits of TVL changes and zero-slippage zero-fee swaps](https://0xsimao.com/findings/renzo-withdrawals-zero-slippage-fee): Renzo - [Lost withdrawals due to `ManagedLeveragedVault::openDen()` using all `asset()` balance](https://0xsimao.com/findings/beraborrow-i-lost-withdrawals-managed-den): Beraborrow Managed Dens - [`ManagedLeveragedVault::executeWithdrawalEpoch()` incorrect ICR and DoSed withdrawals due to not accouting for fees](https://0xsimao.com/findings/beraborrow-i-withdrawal-epoch-withdrawals-fees): Beraborrow Managed Dens