# Withdraw and borrow can be DoSed in BaseRouter Medium · Three Sigma · Lending aggregator · 6th May, 2023 Finding 3S-FUJI-M10 of the Fuji Finance security review. - Report: /reports/fuji-finance - Source: https://cdn.sanity.io/files/qoqld077/staging/32181a28eac3175d15fb8924d249bb0d91ca350c.pdf --- ### Description Withdraw and borrow actions in the BaseRouter require the owner to increase the approval allowances. If the allowance increase and withdrawal action transaction are not done atomically (via a multicall, for example), anyone can withdraw 1 token, which will make the real withdraw action revert due to insufficient balance (borrowing is similar). ### Recommendation Similarly to the deposit(...) action _safePullTokenFrom(...), only the owner of the withdrawal and borrow actions should be able to call these actions directly. To allow someone withdrawing for a user or cross chain withdrawals, the withdrawal should only be allowed if there was a permit action before (same for borrowing). ### Status Acknowledged with the following statement: The issue identified is acknowledged by the Fuji team including the severity and potential for griefing attacks possible with user's excess allowance on the router. The team intends to implement the discussed solution: combining IRouter.Action.PermitBorrow and IRouter.Action.PermitWithdraw followed respectively by borrow or withdraw operations. Then restrict the "pure" IRouter.Action.Withdraw, and IRouter.Action.Borrow to ONLY be callable when msg.sender is the owner. This change will be implemented among other pending changes in Q3 2023. --- Related findings: - [DoSed StrategyRouter:withdrawFromStrategies() if strategyTokenBalancesUsd[i] is too small in the swapping phase](https://0xsimao.com/findings/clip-finance-i-withdraw-balances-usd-phase): Clip Finance Strategies - [Batch:withdraw() can be DoSed by frontrunning it with strategyRouter:allocateToStrategies()](https://0xsimao.com/findings/clip-finance-i-withdraw-frontrunning-allocate-strategies): Clip Finance Strategies - [BatchOut:withdrawFulfill() can be DoSed by spamming withdrawal requests, leading to OOG reverts](https://0xsimao.com/findings/clip-finance-i-withdraw-spamming-withdrawal-reverts): Clip Finance Strategies