# If wLP is blacklisted, then user will not be able to withdraw it Medium · Code4rena · Money market · 15th December, 2023 Finding M-09 of the INIT Capital security review. - Protocol: https://init.capital/ - Report: /reports/init-capital-ii - Codebase: https://github.com/0xsimao/2023-12-initcapital/tree/a53e401529451b208095b3af11862984d0b32177 - Source: https://code4rena.com/reports/2023-12-initcapital --- When users deposit wLP tokens as collateral, then they are checked [to be whitelisted](https://github.com/code-423n4/2023-12-initcapital/blob/main/contracts/core/InitCore.sol#L255). Later, it's possible that for some reason wLP token [will be blacklisted](https://github.com/code-423n4/2023-12-initcapital/blob/main/contracts/core/Config.sol#L145) by governor. And once it's done, then users who already used that wLP token as collateral [will not be able to withdraw them](https://github.com/code-423n4/2023-12-initcapital/blob/main/contracts/core/InitCore.sol#L275). Also same thing exists for the `liquidateWLp` function, which means that in case if position, that is collateralized with wLP that is blacklisted, will become unhealthy, then liquidators [will not be able to liquidate it](https://github.com/code-423n4/2023-12-initcapital/blob/main/contracts/core/InitCore.sol#L327). Sponsor said that blacklisting flow will be as following. - Decrease collateral factor for blacklisted wLp until it becomes 0 - then blacklist wLp Considering this fact I realize that for liquidation this will not be an issue as wLp will have 0 collateralization power when it will be blacklisted. However it's still possible that some users will not decollateralize their wLp tokens yet for some reasom and thus they will not be able to withdraw them later. ### Impact User can't withdraw previously deposited wLP tokens after they were blacklisted. ### Tools Used VsCode ### Recommended Mitigation Steps Even if wLP token is blacklisted now, you still should allow user to withdraw them. After all you have health check function that will guarantee that position has enough collateral. --- Related findings: - [`totalCdsDepositedAmountWithOptionFees` is incorrectly reduced in `CDSLib::withdrawUser()`, leading to stuck option fees](https://0xsimao.com/findings/autonomint-fees-reduced-withdraw-stuck): Autonomint - [Missing Update to `omnichain.totalAvailableLiquidationAmount` in `withdrawUser`](https://0xsimao.com/findings/autonomint-omnichain-available-liquidation-withdraw): Autonomint - [`CDSLib::withdrawUserWhoNotOptedForLiq()` tax is not stored in the treasury](https://0xsimao.com/findings/autonomint-withdraw-opted-liq-stored): Autonomint - [Admin new issuance or user calling `Vault::redeemExpiredLv()` after `Psm::redeemWithCt()` will lead to stuck funds when trying to withdraw](https://0xsimao.com/findings/cork-protocol-issuance-redeem-stuck-withdraw): Cork Protocol