# rebalance(), withdrawAmount needed from the ReservePool can be simplified Low/Info · Three Sigma · Liquid staking · 12th July, 2023 Finding 3S-GLACIER-N04 of the Glacier security review. - Protocol: https://www.glacier.io/ - Report: /reports/glacier - Source: https://cdn.sanity.io/files/qoqld077/production/21bd3b6fa78c55968a6c9c7ea4fd49f34a8bd3d8.pdf --- ### Description In function rebalance(), the withdrawAmount from the ReservePool can be computed inside the first if statement. ### Recommendation Change the code to ```solidity function rebalance() external payable isRole(NETWORK_MANAGER) { ... uint256 withdrawAmount; // new if (balance > 0 && currentReserves < reserveTarget) { uint256 toFill = reserveTarget - currentReserves; uint256 toReserves = toFill > balance ? balance : toFill; withdrawAmount = toFill - toReserves; // new IGReservePool(reservePoolAddress).deposit(toReserves); balance -= toReserves; } else { ... } ``` ### Status Currently being reviewed by the team. --- Related findings: - [`VaultPoolLib::reserve()` will store the `Pa` not attributed to user withdrawals incorrectly and leave in untracked once it expires again](https://0xsimao.com/findings/cork-protocol-attributed-withdrawals-untracked-expires): Cork Protocol - [`totalCdsDepositedAmountWithOptionFees` is incorrectly reduced in `CDSLib::withdrawUser()`, leading to stuck option fees](https://0xsimao.com/findings/autonomint-fees-reduced-withdraw-stuck): Autonomint - [Missing Update to `omnichain.totalAvailableLiquidationAmount` in `withdrawUser`](https://0xsimao.com/findings/autonomint-omnichain-available-liquidation-withdraw): Autonomint - [Halted withdrawals in BatchOut:withdrawFulfill() due to tokens transfer() reverting on 0 transfer amount](https://0xsimao.com/findings/clip-finance-i-halted-withdrawals-withdraw-transfer): Clip Finance Strategies