# _rebalanceWithdraw() mechanism in glAVAX allows arbitrage opportunities by changing the shares/AVAX ratio Crit/High · Three Sigma · Liquid staking · 12th July, 2023 Finding 3S-GLACIER-H04 of the Glacier security review. - Protocol: https://www.glacier.io/ - Report: /reports/glacier - Source: https://cdn.sanity.io/files/qoqld077/production/21bd3b6fa78c55968a6c9c7ea4fd49f34a8bd3d8.pdf --- ### Description The balance available for withdrawals is tracked in address(this).balance. The implementation itself is correct and users will have enough liquidity to withdraw given enough balance is accumulated. However, withdrawing should be done atomically; AVAX should not be withdrawn when withdraws are rebalanced and the shares burned when the requests are fulfilled. Essentially, whenever possible changing the ratio shares/wAVAX ratio should be avoided to prevent MEV opportunities. ### Recommendation Since there are considerable changes involved, a [POC](https://github.com/threesigmaxyz/glacier-contracts-foundry/blob/audit-12-07-2023/contracts/protocol/GlacialAVAX/glAVAXWithdrawPOC.sol) was pushed. In short, instead of withdrawing AVAX and keeping it in the glAVAX contract, a reserved wAVAX amount is tracked, always keeping the shares/wAVAX ratio intact. ### Status Currently being reviewed by the team. --- Related findings: - [FairLauncher::participate() should allow specifying a minimum number of shares due to the overfund mechanism](https://0xsimao.com/findings/districtone-participate-specifying-shares-overfund): DistrictOne - [Market utilization ratio near 100% will DoS deposits as harvest tries to withdraw and reverts](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-deposits-harvest-withdraw-reverts): Exactly Protocol Update - Staking Contract - [Attackers can claim deposits to vaults if users specify the router as receiver and don't withdraw shares after](https://0xsimao.com/findings/fuji-finance-deposits-specify-withdraw-shares): Fuji Finance - [`burnSharesToWithdrawEarnings` burns before math, causing the share value to increase](https://0xsimao.com/findings/teller-finance-burn-shares-withdraw-share): Teller Finance