# Unnecessary user balance check in _withdrawRequest() Low/Info · Three Sigma · Liquid staking · 12th July, 2023 Finding 3S-GLACIER-N12 of the Glacier security review. - Protocol: https://www.glacier.io/ - Report: /reports/glacier - Source: https://cdn.sanity.io/files/qoqld077/production/21bd3b6fa78c55968a6c9c7ea4fd49f34a8bd3d8.pdf --- ### Description The balance of the user when withdrawing against the amount passed in as argument is already checked in the withdraw() function, there's no need to check again in [_withdrawRequest()](https://github.com/JackFrostDev/glacier-contracts/blob/main/contracts/protocol/GlacialAVAX/glAVAX.sol#L632). ### Recommendation Remove the following line ```solidity function _withdrawRequest(uint256 amount) internal { address user = msg.sender; require(amount <= balanceOf(user), "INSUFFICIENT_BALANCE"); // remove this line ... } ``` ### Status Currently being reviewed by the team. --- Related findings: - [Users cannot unstake from YiedlETHStakingEtherfi.sol, because YieldAccount.sol is incompatible with ether.fi's WithdrawRequestNFT.sol](https://0xsimao.com/findings/benddao-unstake-eth-staking-yield): BendDAO - [Slippage protection could be added to LoopedVault::requestWithdraw() in case of black swan event](https://0xsimao.com/findings/yieldoor-iii-slippage-withdraw-black-swan): Yieldoor LoopedVault Update - [`SyrupBitcoinRouter::requestRedeem()` could also check if the asset picked to redeem has liquidity](https://0xsimao.com/findings/maple-finance-iii-syrup-bitcoin-redeem-picked): Maple Withdrawal Queue - [Unnecessary currentEpoch zero check in StandardGovernor and ThresholdGovernor](https://0xsimao.com/findings/m-0-current-epoch-zero-threshold): M^0 Minter Gateway