Steadefi

Summary

Throughout the execution of processWithdrawFailure without updating self.refundee, the remaining fee for adding mobility is sent to the user who called withdraw, resulting in a loss of keeper.

Vulnerability Details

Throughout the execution of processWithdrawFailure without updating self.refundee, the remaining fee for adding mobility is sent to the user who called withdraw, resulting in a loss of keeper.
Further, the user can control the self.withdrawCache.withdrawParams.minWithdrawTokenAmt parameter, which causes the initiated withdraw request to always go to processWithdrawFailure. thus multiple times to get the rest of the In severe cases, this can drain the keeper of all its funds.

Impact

Serious cases can drain all of keeper's funds.

Tools Used

manual

Recommendations

It is recommended to correctly update self.refundee to keeper in the processWithdrawFailure function.