# In LoopStrategy::withdraw(), _updateLastTotalAssets() is called after _withdraw() Low/Info · Three Sigma · Lending · 2nd December 2024 Finding 3S-MORE-N01 of the MORE Optimizer security review. - Protocol: https://www.more.markets/ - Report: /reports/more-optimizer - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-12-02-more-markets.pdf --- ### Description In LoopStrategy::withdraw(), _updateLastTotalAssets() is called after _withdraw(). ### Recommendation Follow the CEI pattern and update the total assets before the _withdraw() call. ### Status Addressed in [#c4b4f1a](https://github.com/MoreLabsXYZ/MORE-Optimizers/commit/c4b4f1a3b957b7eb676c067b34446960f931c36f). Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [RebalanceLogic::rebalanceCallback() doesn't update lastTotalAssets when rebalancing from morpho to morpho](https://0xsimao.com/findings/yieldoor-ii-rebalance-callback-rebalancing-morpho): Yieldoor LoopedVault - [Incoming Redemption Assets not being tracked when repurchase is called](https://0xsimao.com/findings/cork-protocol-incoming-redemption-tracked-repurchase): Cork Protocol - [Inconsistent updateTotalAssets modifier usage](https://0xsimao.com/findings/yieldoor-ii-inconsistent-assets-modifier-usage): Yieldoor LoopedVault - [Vesting interest is not reset to 0 in case there is no interest in LoopedVault11::updateTotalAssets()](https://0xsimao.com/findings/yieldoor-ii-vesting-interest-reset-vault11): Yieldoor LoopedVault