c4-submissions commented 1 year ago

Lines of code

https://github.com/code-423n4/2023-09-asymmetry/blob/main/contracts/AfEth.sol#L176

Vulnerability details

Impact

AfEth.requestWithdraw function calculates withdraw time incorrectly, which cause user to wait more time to receive funds.

Proof of Concept

When user wants to withdraw, then he needs to initiate requestWithdraw. As some part of funds are locked as cvx token inside vlcvx that means that they should be withdrawn. When you lock cvx then amount is locked for some period, so you can't withdraw it for that time.

For such reason withdrawTime function exists, which purpose is to calculate time when needed amount will be available to withdraw.

The problem is that AfEth.requestWithdraw function checks when it will be possible to withdraw whole amount. But as afEth consists of 2 tokens that means that only part of amount should be withdrawn from votium strategy. And this amount is votiumWithdrawAmount.

Because of that mistake user may wait more time to get his funds.

Tools Used

VsCode

Recommended Mitigation Steps

Calculate withdraw time for votiumWithdrawAmount only.