Users can withdraw their funds immediately when they are over-leveraged
`Accounts.withdraw` makes two checks before processing a withdrawal.\\nFirst, the method checks that the amount requested for withdrawal is not larger than the user's balance for the asset in question:\\n```\\nfunction withdraw(address \\_accountAddr, address \\_token, uint256 \\_amount) external onlyAuthorized returns(uint256) {\\n\\n    // Check if withdraw amount is less than user's balance\\n    require(\\_amount <= getDepositBalanceCurrent(\\_token, \\_accountAddr), "Insufficient balance.");\\n    uint256 borrowLTV = globalConfig.tokenInfoRegistry().getBorrowLTV(\\_token);\\n```\\n\\nSecond, the method checks that the withdrawal will not over-leverage the user. The amount to be withdrawn is subtracted from the user's current “borrow power” at the current price. If the user's total value borrowed exceeds this new borrow power, the method fails, as the user no longer has sufficient collateral to support their borrow positions. However, this `require` is only checked if a user is not already over-leveraged:\\n```\\n// This if condition is to deal with the withdraw of collateral token in liquidation.\\n// As the amount if borrowed asset is already large than the borrow power, we don't\\n// have to check the condition here.\\nif(getBorrowETH(\\_accountAddr) <= getBorrowPower(\\_accountAddr))\\n    require(\\n        getBorrowETH(\\_accountAddr) <= getBorrowPower(\\_accountAddr).sub(\\n            \\_amount.mul(globalConfig.tokenInfoRegistry().priceFromAddress(\\_token))\\n            .mul(borrowLTV).div(Utils.getDivisor(address(globalConfig), \\_token)).div(100)\\n        ), "Insufficient collateral when withdraw.");\\n```\\n\\nIf the user has already borrowed more than their “borrow power” allows, they are allowed to withdraw regardless. This case may arise in several circumstances; the most common being price fluctuation.
Disallow withdrawals if the user is already over-leveraged.\\nFrom the comment included in the code sample above, this condition is included to support the `liquidate` method, but its inclusion creates an attack vector that may allow users to withdraw when they should not be able to do so. Consider adding an additional method to support `liquidate`, so that users may not exit without repaying debts.
```\\nfunction withdraw(address \\_accountAddr, address \\_token, uint256 \\_amount) external onlyAuthorized returns(uint256) {\\n\\n    // Check if withdraw amount is less than user's balance\\n    require(\\_amount <= getDepositBalanceCurrent(\\_token, \\_accountAddr), "Insufficient balance.");\\n    uint256 borrowLTV = globalConfig.tokenInfoRegistry().getBorrowLTV(\\_token);\\n```\\n