Sturdy contest - z3s's results

Lines of code

https://github.com/code-423n4/2022-05-sturdy/blob/main/smart-contracts/LidoVault.sol#L142

Vulnerability details

Impact

LidoVault.sol#L141 In case of ETH withdraw request from user. after exchanging stETH -> ETH _withdrawFromYieldPool() send ETH to user but the require check is after the return of receivedETHAmount so this check won't happen. and in if call is going to fail it won't throw and the exchange won't revert. and user won't recieve the ETH.

Recommended Mitigation Steps:

swap the lines:

(bool sent, bytes memory data) = address(_to).call{value: receivedETHAmount}('');
- return receivedETHAmount;
require(sent, Errors.VT_COLLATERAL_WITHDRAW_INVALID);
+ return receivedETHAmount;

Non Critical

Unused local variable in LidoVault.sol:

data is unused so it can be removed.

LidoVault.sol:91
    (bool sent, bytes memory data) = LIDO.call{value: msg.value}('');

LidoVault.sol:140
    (bool sent, bytes memory data) = address(_to).call{value: receivedETHAmount}('');

Recommended Mitigation Steps:

Remove data:

(bool sent, ) = LIDO.call{value: msg.value}('');

(bool sent, ) = address(_to).call{value: receivedETHAmount}('');