Minato7namikazi - Lido FIV Unfinalized Fixed Withdrawals Can Block Vault Finalization

[sherlock-admin2]

Minato7namikazi

High

Lido FIV Unfinalized Fixed Withdrawals Can Block Vault Finalization

https://github.com/sherlock-audit/2024-08-saffron-finance/blob/38dd9c8436db341c331f1b14545770c1766fc0ee/lido-fiv/contracts/LidoVault.sol#L690

in fn claimOngoingFixedWithdrawals

The function doesn't handle the scenario where a fixed user has requested a withdrawal, but the withdrawal hasn't been finalized by the time the vault ends. This can lead to a situation where some fixed users might not receive their funds properly when the vault ends.

function claimOngoingFixedWithdrawals() internal {
    uint256 arrayLength = fixedOngoingWithdrawalUsers.length;
    for (uint i = 0; i < arrayLength; i++) {
        address fixedUser = fixedOngoingWithdrawalUsers[i];
        fixedToPendingWithdrawalAmount[fixedUser] = claimFixedVaultOngoingWithdrawal(fixedUser);
        delete fixedOngoingWithdrawalUsers[i];
    }
}

The vulnerability arises because:

1. The function assumes that all ongoing fixed withdrawals can be claimed successfully.
2. It doesn't check if the Lido withdrawal for each user has been finalized.
3. If a withdrawal hasn't been finalized, claimFixedVaultOngoingWithdrawal will revert, causing the entire function to revert.

This can have several impacts on the project:

1. It could prevent the vault from ending properly if any fixed user's withdrawal is not yet finalized.

2. It might lead to some fixed users not receiving their funds when the vault ends.

3. It could create an inconsistent state where some users' withdrawals are processed while others are not.

   To fix this, the function should:

4. Check if each withdrawal request has been finalized before attempting to claim it.

5. Handle cases where a withdrawal is not yet finalized, perhaps by keeping track of these users separately.

• Why it can be triggered: The function claimOngoingFixedWithdrawals is called within finalizeVaultEndedWithdrawals when the vault is ending. It attempts to claim all ongoing fixed withdrawals without checking if the Lido withdrawals have been finalized.

• Potential Impact: While the bug doesn't lead to loss of funds, it can cause issues with the proper distribution of funds and potentially lock the contract in an unfinished state. Here's a potential flow of events:

PoC Example:

a) The vault duration ends, and a user calls finalizeVaultEndedWithdrawals. b) Inside this function, claimOngoingFixedWithdrawals is called. c) Let's say there are three fixed users with ongoing withdrawals:

• User A: Withdrawal finalized
• User B: Withdrawal pending
• User C: Withdrawal finalized d) The function will successfully process User A's withdrawal. e) When it reaches User B, the claimFixedVaultOngoingWithdrawal will fail because the Lido withdrawal isn't finalized. f) This causes the entire claimOngoingFixedWithdrawals function to revert. g) As a result, the vaultEndedWithdrawalsFinalized flag is never set to true. h) The vault is now stuck in a state where it can't be fully finalized, and some users can't withdraw their funds.

Impact:

1. Vault Finalization Failure: The vault cannot be properly finalized if any fixed user's withdrawal is pending when finalizeVaultEndedWithdrawals is called.
2. Fund Distribution Issues: Some users might not be able to withdraw their funds as expected.
3. Locked State: The contract could become locked in an unfinished state, requiring manual intervention or a contract upgrade to resolve.