# BasicVault::_redeem() burns newAmount but redeems amount, allowing attackers to drain the vault Crit/High · Three Sigma · Cross-chain liquidity layer 1 · 25th June, 2024 Finding 3S-Mitosis-C01 of the Mitosis security review. - Protocol: https://mitosis.org/ - Report: /reports/mitosis - Source: https://cdn.sanity.io/files/qoqld077/production/b6b3bd7bb47407d99e76abb7c6dc615c1db5018e.pdf --- ### Description BasicVault::_redeem() is inconsistent as it burns newAmount, the value returned from the hook, but pushes a request to the redeem queue with amount. As hook::reportRedeem() will cap the amount to redeem to the current load, the last user to withdraw may specify a huge amount to redeem, which will be capped to the remaining load, burning the capped newAmount shares, but pushing a request with the huge amount. ### Recommendation uint256 requestId = $v2.redeemQueue.push(_msgSender(), newAmount); ### Status Addressed in [#69d1369](https://github.com/mitosis-org/evm/pull/190/commits/69d13696017a0e5f02a5b2f534145b9beab683d3). --- Related findings: - [`Borrowing::redeemYields` debits `ABOND` from `msg.sender` but redeems to `user` using `ABOND.State` data from `user`](https://0xsimao.com/findings/autonomint-redeem-yields-debits-redeems): Autonomint - [REBALANCER_ROLE can drain funds by rebalancing in a loop in the BorrowingVault](https://0xsimao.com/findings/fuji-finance-rebalancer-drain-rebalancing-loop): Fuji Finance - [Attackers will steal the reserve from the `Vault` by receiving `ra` in `FlashSwapRouter::__swapDsforRa()`](https://0xsimao.com/findings/cork-protocol-steal-receiving-flash-dsfor): Cork Protocol - [Admin new issuance or user calling `Vault::redeemExpiredLv()` after `Psm::redeemWithCt()` will lead to stuck funds when trying to withdraw](https://0xsimao.com/findings/cork-protocol-issuance-redeem-stuck-withdraw): Cork Protocol