Albort - The internal function `claimFixedVaultOngoingWithdrawal` uses `msg.sender` instead of the passed `user` parameter.

[sherlock-admin4]

Albort

Medium

The internal function claimFixedVaultOngoingWithdrawal uses msg.sender instead of the passed user parameter.

Summary

The internal function claimFixedVaultOngoingWithdrawal uses msg.sender instead of the passed user parameter.

Vulnerability Detail

In the internal function claimFixedVaultOngoingWithdrawal, although the function accepts a user parameter, it uses msg.sender when calling claimWithdrawals.

Impact

This will result in incorrect event logging.

Code Snippet

https://github.com/sherlock-audit/2024-08-saffron-finance/blob/main/lido-fiv/contracts/LidoVault.sol#L831

https://github.com/sherlock-audit/2024-08-saffron-finance/blob/main/lido-fiv/contracts/LidoVault.sol#L1181

Tool used

Manual Review

Recommendation

Replace msg.sender with the passed user parameter to ensure consistency and correctness in the function logic.