# In case of high ltv and unfavourable swap, onMoreFlashLoan() may underflow Low/Info · Three Sigma · Lending · 2nd December 2024 Finding 3S-MORE-L01 of the MORE Optimizer security review. - Protocol: https://www.more.markets/ - Report: /reports/more-optimizer - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-12-02-more-markets.pdf --- ### Description LoopStrategy::onMoreFlashLoan() underflows when cost > collateralToWithdraw, which may happen in case the market has a high ltv and significant slippage occurs. ### Recommendation Consider using the wFlow from the vault in this case. ### Status Acknowledged. Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [FlashSwapRouter::emptyReserve() and FlashSwapROuter::emptyReservePartial() functions return incorrect values](https://0xsimao.com/findings/cork-protocol-flash-empty-outer-partial): Cork Protocol - [Attackers will steal the reserve from the `Vault` by receiving `ra` in `FlashSwapRouter::__swapDsforRa()`](https://0xsimao.com/findings/cork-protocol-steal-receiving-flash-dsfor): Cork Protocol - [`FlashRolloverLoan_G5` will not work for certain tokens due to not setting the approval to `0` after repaying a loan](https://0xsimao.com/findings/teller-finance-flash-rollover-approval-repaying): Teller Finance - [`FlashRolloverLoan_G5` will fail for `LenderCommitmentGroup_Smart` due to `CollateralManager` pulling collateral from `FlashRolloverLoan_G5`](https://0xsimao.com/findings/teller-finance-flash-rollover-collateral-pulling): Teller Finance