# Balance check in Vault::withdraw() does not take fees into account Crit/High · Three Sigma · Cross-chain bridge · 15th July, 2024 Finding 3S-OB-M01 of the Orange Bridge security review. - Protocol: https://www.orangeweb3.com/ - Report: /reports/orange - Source: https://cdn.sanity.io/files/qoqld077/production/686ad4e1d5035d69002f5f97e281e3c5a8b7ce00.pdf --- ### Description Vault::withdraw() transfers funds to an user if address([this](https://github.com/nomad-xyz/ExcessivelySafeCall/blob/main/src/ExcessivelySafeCall.sol#L24))).balance >= amount, which may transfer funds resulting from fees. ### Recommendation Replace the check by address(this)).balance - totalFees >= amount to make sure fees can always be withdrawn. ### Status Addressed in [#cdd25c9](https://github.com/orangecryptohq/orange-bridge-contract/commit/cdd25c91a04caebf11d8cc82560ffee3ae6c7072). --- Related findings: - [DoSed liquidations as `PrizeVault::liquidatableBalanceOf()` does not take into account the `mintLimit` when the token out is the asset](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-liquidations-prize-liquidatable-mint): PoolTogether Prize Layer - [ERC4626YieldBackend.withdrawSurplus() uses convertToAssets() which doesn't account for fees](https://0xsimao.com/findings/superfluid-erc4626-yield-withdraw-fees): Superfluid Yield Backends - [Mismatch between yield amount deposited in shares calculation and getAccountYieldBalance()](https://0xsimao.com/findings/benddao-mismatch-yield-deposited-shares): BendDAO - [Price formula in `TpdaLiquidationPair._computePrice()` does not account for a jump in liquidatable balance](https://0xsimao.com/findings/pooltogether-the-prize-layer-for-defi-price-tpda-liquidation-compute): PoolTogether Prize Layer