Sturdy contest - peritoflores's results

Lines of code

https://github.com/code-423n4/2022-05-sturdy/blob/78f51a7a74ebe8adfd055bdbaedfddc05632566f/smart-contracts/LidoVault.sol#L141-L142

Vulnerability details

Impact

Lose of funds

Proof of Concept

In the function _withdrawFromYield#LidoVault.sol after transferring ETH there is a return and just after there is a require. This require will never be reached as the return finishes the execution. As the result the transfer will always be considered valid.

(bool sent, bytes memory data) = address(_to).call{value: receivedETHAmount}('');                 #L141
  return receivedETHAmount;
  require(sent, Errors.VT_COLLATERAL_WITHDRAW_INVALID);

Recommended Mitigation Steps

Invert lines 141 and 142

(bool sent, bytes memory data) = address(_to).call{value: receivedETHAmount}('');
require(sent, Errors.VT_COLLATERAL_WITHDRAW_INVALID);
return receivedETHAmount