# In glAVAX, function _rebalanceWithdraw() withdraws incorrect amount from WAVAX address Crit/High · Three Sigma · Liquid staking · 12th July, 2023 Finding 3S-GLACIER-H05 of the Glacier security review. - Protocol: https://www.glacier.io/ - Report: /reports/glacier - Source: https://cdn.sanity.io/files/qoqld077/production/21bd3b6fa78c55968a6c9c7ea4fd49f34a8bd3d8.pdf --- ### Description In the function _rebalanceWithdraw() if it is necessary to withdraw from WAVAX in order to satisfy a withdrawal, the [code](https://github.com/threesigmaxyz/glacier-contracts-foundry/blob/audit-12-07-2023/contracts/protocol/GlacialAVAX/glAVAX.sol#L666) will compare the balance of the WAVAX contract and how much is needed to satisfy the withdrawal. When doing this comparison, if it finds that the balance of the WAVAX contract is bigger than how much is needed to satisfy the withdrawal, then it should only withdraw how much it needs. If the opposite happens it should only withdraw the balance in the WAVAX contract. Currently the code does the opposite. ### Recomendation Change the line in code from: uint256 amountToWithdraw = wavaxBalance > tokenNeeded ? wavaxBalance : tokenNeeded; To: uint256 amountToWithdraw = wavaxBalance > tokenNeeded ? tokenNeeded : wavaxBalance; ### Status This issue has been addressed in commit: [#dad2182](https://github.com/threesigmaxyz/glacier-contracts-foundry/commit/dad2182ec55313138d9cb2d13f4625ae0d25d6cf). --- Related findings: - [`Vault::withdraw()` withdraws too much liquidity leading to idle capital and loss of fees](https://0xsimao.com/findings/yieldoor-withdraw-withdraws-capital-fees): Yieldoor - [Precision Loss in `notifyRewardAmount` Function Causes Unclaimable RewardToken](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-precision-notify-reward-unclaimable): Exactly Protocol Update - Staking Contract - [`VaultV2::withdraw/redeem()` are vulnerable to slippage, so another function could be added to protect users](https://0xsimao.com/findings/morpho-vault-v2-withdraw-redeem-slippage-protect): Morpho Vault V2 - [Use of `address.transfer` instead of the recommended `address.call{value: amount}("")`](https://0xsimao.com/findings/blast-ido-pools-transfer-recommended-call-value): Blast IDO Pools