H-02 Unmitigated

[c4-submissions]

Lines of code

Vulnerability details

Mitigation of H-02: Issue mitigated with ERROR

Mitigated issue

H-02: Zero amount withdrawals of SafEth or Votium will brick the withdraw process

The issue was that withdrawing afEth might imply a withdrawal of 0 safEth or vAfEth, which reverts.

Mitigation review

In the case of withdrawing 0 safEth, the call to SafEth.unstake() is now skipped in AfEth.withdraw(). In the case of withdrawing 0 vAfEth, AfEth.requestWithdraw() still calls VotiumStrategy.requestWithdraw(0). When finalizing the withdrawal with AfEth.withdraw(), which calls VotiumStrategy.withdraw(), a check is made to only call sellCvx() with nonzero amounts. The request and withdrawal will thus not revert.

Mitigation error

Since a VotiumStrategy.requestWithdraw(0) is still placed, this queues it to the end of all previous withdrawal requests (as if an infinitesimal amount is to be withdrawn), incurring an artificially prolonged withdrawal time.

[toshiSat]

Will add check for zero amounts

[toshiSat]

I cannot label this one for some reason, but this feels like a Low priority and confirming

[c4-judge]

0xleastwood marked the issue as confirmed for report

[c4-judge]

0xleastwood marked the issue as satisfactory

[c4-judge]

0xleastwood marked the issue as not confirmed for report

[c4-judge]

0xleastwood marked the issue as confirmed for report

[c4-judge]

0xleastwood marked the issue as nullified

[c4-judge]

0xleastwood marked the issue as not confirmed for report

[c4-judge]

0xleastwood marked the issue as not nullified

[c4-judge]

0xleastwood marked the issue as satisfactory