Summary

The Withdraw function in the BridgeSteth.sol is not protected to re-enter. Here the user with diamond role can re-enter and can empty the whole pool with Steth.

Vulnerability Details

The withdraw() method is not protected against re-enterancy attack and the user with diamond privileges can re-enter again and again and empty the whole pool as there is also not a check for balance of the diamond privilege user.

Impact

Re-enterancy

Tools Used

Manual

Recommendations

Use Add non-reentrancy guard.