Liquid Staking

Summary

The _withdrawLiquidity function in the StakingPool contract contains a loop that prematurely exits after a partial withdrawal, potentially leaving user funds inaccessible when they should be available across multiple strategies.

Details

The _withdrawLiquidity function iterates through the available strategies to withdraw the requested amount. However, the loop structure is flawed:

• If a strategy can fulfill the entire withdrawal amount, it correctly processes the withdrawal and exits the loop.

• If a strategy can only partially fulfill the withdrawal, it processes that partial amount but then fails to continue to the next strategy.

This means that if the total requested withdrawal amount is spread across multiple strategies, the function will only withdraw from the first strategy it encounters with available funds, even if subsequent strategies could fulfill the remaining amount.

Impact

This issue can lead to several significant problems:

1. Incomplete Withdrawals: Users may receive less than their requested withdrawal amount, even when sufficient funds are available across multiple strategies.

2. Funds Lockup: User funds may become temporarily or permanently inaccessible if they're spread across strategies.

3. Reduced Liquidity: The overall liquidity of the pool may appear lower than it actually is, as funds in subsequent strategies are not being utilized for withdrawals.

4. User Trust: Incomplete or failed withdrawals when funds should be available could significantly erode user trust in the platform.

Code Snippet

Recommendation

To fix this issue, the loop should continue to the next strategy if a partial withdrawal occurs. Here's a corrected version of the function:

This modification ensures that the loop continues through all strategies until the full withdrawal amount is processed or all strategies have been checked. It also adds a final check to ensure the full amount was withdrawn, reverting the transaction if not.