Steadefi

Summary

The processDepositFailure() and processDepositFailureLiquidityWithdrawal() functions are meant to handle deposit failures and refund tokens. However, errors or exceptions occurring within these functions may prevent proper refunds from being issued.

Vulnerability Details

If a deposit fails, these functions are relied upon to swap tokens and refund the user. But internal failures are not caught, so refunds would not be dispatched. This could leave funds inaccessible.

Reproduction:

Deposit fails, invoking a ProcessDepositFailure function
An error occurs within the function during swap calculations
Refund tokens are not transferred due to the uncaught error

Impact

Users may not receive owed refunds after deposit failures

Tools Used

Manual Review

Recommendations

Wrap critical refund sections in require statements to revert state on errors. This ensures users always receive owed tokens back even if a ProcessDepositFailure function fails internally.