Sturdy contest - tabish's results

Lines of code

https://github.com/code-423n4/2022-05-sturdy/blob/78f51a7a74ebe8adfd055bdbaedfddc05632566f/smart-contracts/LidoVault.sol#L142

Vulnerability details

Impact

Detailed description of the impact of this finding.

If the user uses smart contract to interact with the protocol with no receive/ payable fallback function, sending of ETH to the user will fail and the ETH would stay in the contract and withdraw action would successfully pass as the amount of eth sent is returned before checking require in LidoVault.sol#L142 . Also there seems no way to emergency withdraw the funds for user without upgrading the contract.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

https://github.com/code-423n4/2022-05-sturdy/blob/78f51a7a74ebe8adfd055bdbaedfddc05632566f/smart-contracts/LidoVault.sol#L142

Recommended Mitigation Steps

require should be before return

      // send ETH to user
      (bool sent, bytes memory data) = address(_to).call{value: receivedETHAmount}('');
      require(sent, Errors.VT_COLLATERAL_WITHDRAW_INVALID);
      return receivedETHAmount;
    } else {