ak1 - withdrawalRequest can be abused by user without paying fee to dao.

[sherlock-admin]

ak1

high

withdrawalRequest can be abused by user without paying fee to dao.

Summary

When there are not enough funds, user can raise a request for withdraw for X amount and can call the withdrawAllowance() to withdraw.

The issue here is, user can raise request which will not give any fee in uint256 govFee = (_value * governanceFee) / 10_000;

Vulnerability Detail

Impact

without paying fee ro dao user can withdraw.

Code Snippet

https://github.com/sherlock-audit/2023-01-derby/blob/main/derby-yield-optimiser/contracts/MainVault.sol#L149-L189

Tool used

Manual Review

Recommendation

During the withdrawal request, check the amount can give any fee or not. If not , do not allow request.