# Queue MapleWithdrawalManager may revert due to honest removeShares() or manual redeem calls Low/Info · Three Sigma · Institutional lending · 16th November, 2023 Finding 3S-MAPLE-L01 of the Maple Withdrawal Manager security review. - Protocol: https://maple.finance/ - Report: /reports/maple-finance-ii-2023 - Source: https://cdn.sanity.io/files/qoqld077/production/34f2311ad7e8315d043e23054e794c136f19a079.pdf --- ### Description The queue withdrawal manager [limits](https://github.com/maple-labs/withdrawal-manager-queue-private/blob/749a035a3531c10d7e5d9b84af2a1115d78880b2/contracts/MapleWithdrawalManager.sol#L172) the sharesToProcess in processRedemptions() to the totalShares. This might make the call revert if non malicious users [remove](https://github.com/maple-labs/withdrawal-manager-queue-private/blob/749a035a3531c10d7e5d9b84af2a1115d78880b2/contracts/MapleWithdrawalManager.sol#L210) shares or do [manual](https://github.com/maple-labs/withdrawal-manager-queue-private/blob/749a035a3531c10d7e5d9b84af2a1115d78880b2/contracts/MapleWithdrawalManager.sol#L293) redeems. Another concurrency issue is if the available liquidity is just enough to cover for a processRedemptions() call, but someone frontruns it and does a manual redeem. ### Recommendation Instead of reverting if the processedShares argument is bigger than totalShares, limit it: ```solidity function processRedemptions(uint256 sharesToProcess_) external override whenProtocolNotPaused nonReentrant onlyRedeemer { ... uint256 cachedTotalShares_ = totalShares; if (sharesToProcess_ > cachedTotalShares_) sharesToProcess_ = cachedTotalShares_; ... } ``` It's trickier to solve the lack of liquidity concurrency issue, as it would require allowing [partial](https://github.com/maple-labs/withdrawal-manager-queue-private/blob/v1.0.0-rc.0/contracts/MapleWithdrawalManager.sol#L172) redemptions. ### Status Addressed in [#7dbcd37](https://github.com/maple-labs/withdrawal-manager-queue-private/pull/23/commits/7dbcd3755955d41ca5ed70db9c17eca8eddcaafc) --- Related findings: - [BasicVault::manualRedeem() and BasicVault::manualDeposit() are inconsistent](https://0xsimao.com/findings/mitosis-manual-redeem-deposit-inconsistent): Mitosis - [An attacker may DoS user Fluid balance increases by frontrunning `FluidLocker::claim()` calls and calling `EP_PROGRAM_MANAGER::batchUpdateUserUnits()` directly](https://0xsimao.com/findings/superfluid-locker-system-increases-frontrunning-program-directly): Superfluid Locker System - [RedeemQueue::get() reverts due to underflow when it should revert and throw the correct error](https://0xsimao.com/findings/mitosis-redeem-queue-reverts-underflow): Mitosis - [BasicVault::_deposit() should always resolve with idle balance as the redeem queue may be disabled with requests pending](https://0xsimao.com/findings/mitosis-deposit-resolve-redeem-queue): Mitosis