Merkle proof can be reused in withdraw function in PriorityPool
Summary
Merkle proof can be reused for withdrawal in Priority Pool which can cause lack of liquidity for future withdrawal with unused merkle proof.
Vulnerability Details
The withdrawfunction in PriorityPool.soldoes not track if merkle proof has been used. It only verifies whether merkle proof is valid or not.
Impact
Merkle proof can be reused to unqueue token leading to higher withdrawal amount by the user which could cause lack of liquidity for future withdrawal with valid proof.
Tools Used
Manual review
Recommendations
Track and verify used merkle proof.
Lead Judging Commences
Same merkle proof used for `claimLSDTokens` as well as `unqueueTokens`
It does concern different variables. But using the same merkle inside 3 different functions is not a good practice. Nonces, separators and safety.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.