# User may be requesting/fulfilling withdrawals at better rates than the real share/asset ratio Low/Info · 0xSimao · Leveraged yield farming · 23rd June 2025 Finding L-7 of the Yieldoor LoopedVault Update security review. - Protocol: https://app.yieldoor.com/ - Report: /reports/yieldoor-iii - Source: https://github.com/0xSimao/audits/blob/main/0xSimao/2025-06-23-yieldoor-iii.pdf --- **Description:** `LoopedVault::requestWithdraw(`) [burns](https://github.com/spacegliderrrr/loopedVault/blob/master/src/LoopedVaultV1_1.sol#L517) shares as per the current `totalAssets()`, which uses a cached `lastTotalAssets`. In case the LoopedVault is liquidated or its value simply lowers (collateral PT price goes down), but it's in the middle of a vesting interval, this will not be reflected on `totalAssets()`, and users will withdraw at a better rate than they really should. The same happens on `LoopedVault::fulfillWithdraw()`. **Recommended Mitigation:** Optimally, the ratio used on withdrawals should be the worse one for the user, so ideally it should calculate the real total assets and use them in the shares calculation if it is lower. The same should also be compared when fulfilling withdrawals. --- Related findings: - [Anyone can grief users, stopping them from fulfilling their withdrawals](https://0xsimao.com/findings/clip-finance-i-grief-stopping-fulfilling-withdrawals): Clip Finance Strategies - [Utilization rates are 0 when average assets are 0, which may be used to game maturity borrows / deposits / withdrawals](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-average-borrows-deposits-withdrawals): Exactly Protocol Update - Staking Contract - [Lost withdrawals due to `ManagedLeveragedVault::openDen()` using all `asset()` balance](https://0xsimao.com/findings/beraborrow-i-lost-withdrawals-managed-den): Beraborrow Managed Dens - [Attacker can DoS user withdrawals at no cost](https://0xsimao.com/findings/aegis-attacker-user-withdrawals-cost): Aegis Staked YUSD