# BasicVault::_deposit() should always resolve with idle balance as the redeem queue may be disabled with requests pending Medium · Three Sigma · Cross-chain liquidity layer 1 · 25th June, 2024 Finding 3S-Mitosis-M06 of the Mitosis security review. - Protocol: https://mitosis.org/ - Report: /reports/mitosis - Source: https://cdn.sanity.io/files/qoqld077/production/b6b3bd7bb47407d99e76abb7c6dc615c1db5018e.pdf --- ### Description BasicVault::_deposit() only calls BasicVault::_resolveWithIdleBalance() if the redeem queue is enabled; however, requests must be claimed if they were created before the redeem queue was disabled, so the idle balance must be reserved even when the redeem queue is disabled. ### Recommendation Always resolve with idle balance in the BasicVault::_deposit() function. ### Status Addressed in [#edf8184](https://github.com/mitosis-org/evm/pull/191/commits/edf81844d18859e0d7c7d454b7c97bceef2313ed). --- Related findings: - [Destination Vault rewards are not added to idleIncrease when info.totalAssetsPulled > info.totalAssetsToPull](https://0xsimao.com/findings/tokemak-rewards-info-pulled-pull): Tokemak - [`Vault::withdraw()` withdraws too much liquidity leading to idle capital and loss of fees](https://0xsimao.com/findings/yieldoor-withdraw-withdraws-capital-fees): Yieldoor - [Incorrect withdraw queue balance in TVL calculation](https://0xsimao.com/findings/renzo-withdraw-queue-tvl-calculation): Renzo - [Queue MapleWithdrawalManager may revert due to honest removeShares() or manual redeem calls](https://0xsimao.com/findings/maple-finance-ii-queue-withdrawal-shares-redeem): Maple Withdrawal Manager