Summary

BridgeRouterFacet.withdrawTapp should update yield.

Vulnerability Details

BridgeRouterFacet.withdrawTapp allows dao to withdraw fees from the protocol. This function will change s.vaultUser[vault][address(this)].ethEscrowed.

Shorters in the protocol receive rewards for the amount of zeth collateral that they have provided. Protocol also receives part of this funds as fee. As result this funds also earn additional fee. But in case if fees are withdrawn before updateYield call, then protocol will not receive additional yields.

Impact

Protocol receives less amount of yields.

Tools Used

VsCode

Recommendations

When withdraw fees, make sure that updateYield is called.