# CEI pattern is not followed on LoopedVault::fulfillWithdraw() Low/Info · 0xSimao · Leveraged yield farming · 23rd June 2025 Finding L-3 of the Yieldoor LoopedVault Update security review. - Protocol: https://app.yieldoor.com/ - Report: /reports/yieldoor-iii - Source: https://github.com/0xSimao/audits/blob/main/0xSimao/2025-06-23-yieldoor-iii.pdf --- **Description:** `LoopedVault::fulfillWithdraw()` [transfers](https://github.com/spacegliderrrr/loopedVault/blob/master/src/LoopedVaultV1_1.sol#L539) the asset before updating the state, breaking the CEI pattern. **Recommended Mitigation:** Transfer the assets at the end of the function. **0xSimao:** Fixed in [#2a378db](https://github.com/spacegliderrrr/loopedVault/commit/2a378db6c6356887fd029685cc947e4eaa2270b3). --- Related findings: - [CEI pattern is not followed in `GovernorTimelock::executeProposals()`](https://0xsimao.com/findings/maple-finance-ii-cei-followed-timelock-proposals): Maple Governor Timelock - [Checks effects interactions pattern is now always followed](https://0xsimao.com/findings/orange-effects-interactions-now-followed): Orange Bridge - [Checks effects interactions pattern is not always followed](https://0xsimao.com/findings/singularity-effects-interactions-pattern-followed): Singularity - [Checks-effects-interations pattern is not always followed, which can be used to drain all tokens](https://0xsimao.com/findings/singularity-effects-interations-followed-drain): Singularity