# Withdraw snapshot logic can be tricked allowing users to withdraw right away Medium · Three Sigma · Liquid staking · 12th July, 2023 Finding 3S-GLACIER-M02 of the Glacier security review. - Protocol: https://www.glacier.io/ - Report: /reports/glacier - Source: https://cdn.sanity.io/files/qoqld077/production/21bd3b6fa78c55968a6c9c7ea4fd49f34a8bd3d8.pdf --- ### Description The current withdraw snapshot implementation allows users to withdraw a certain amount after other users withdraw this amount. It is a fair system such that users that want to withdraw a bigger quantity have to wait more time. However, the system can be tricked by splitting the withdrawal amount into smaller parts. For example, someone who wants to withdraw 50000 AVAX would have to wait for other people to withdraw 50000 AVAX first before they can withdraw. However, if this person placed 1000 withdrawal requests of 50 AVAX each, they could withdraw their 50000 AVAX just after 50 AVAX is withdrawn from other users, not the full 50000. ### Recommendation Withdraw requests are placed whenever there is not enough liquidity to enable user withdrawals. Thus, users have to wait for deposits or fulfillWithdrawal() calls from the network. As the current implementation can be tricked, it's safer to fallback to a slightly less elegant solution. Similarly to [Benqi Finance](https://github.com/Benqi-fi/BENQI-Smart-Contracts/blob/master/sAVAX/StakedAvax.sol#L610), use timestamps to allow users to claim their withdrawal requests. There should be a cooldown period that they have to wait to be able to claim their withdrawal request and a redeem period which after it, the reserved wAVAX can be placed again to the network. ### Status Currently being reviewed by the team. --- Related findings: - [Wrong reward distribution between early and late depositors because of the late `syncRewards()` call in the cycle, `syncReward()` logic should be executed in each withdraw or deposits (without reverting)](https://0xsimao.com/findings/gogopool-reward-rewards-withdraw-deposits): GoGoPool - [Users cannot unstake from YiedlETHStakingEtherfi.sol, because YieldAccount.sol is incompatible with ether.fi's WithdrawRequestNFT.sol](https://0xsimao.com/findings/benddao-unstake-eth-staking-yield): BendDAO - [Users redeeming early will withdraw `Ra` without decreasing the amount locked, which will lead to stolen funds when withdrawing after expiry](https://0xsimao.com/findings/cork-protocol-redeeming-withdraw-locked-stolen): Cork Protocol - [Attackers can claim deposits to vaults if users specify the router as receiver and don't withdraw shares after](https://0xsimao.com/findings/fuji-finance-deposits-specify-withdraw-shares): Fuji Finance