Summary

WithdrawalPool::performUpkeep is supposed to be called by Chainlink as an automation, but anyone can call the function if the conditions are met, providing an incorrect value for the parameter _performData, forcing the withdraw function to execute with less vaults than intended, resulting in less rewards being withdrawn.

Vulnerability Details

As long as the vault passed in parameter is the last vault use, withdraw will execute, and performUpkeep will go on a cooldown for minTimeBetweenWithdrawals amount of time.

Impact

Less funds withdrawn for stakers, or even no funds if the vault is empty.

Tools Used

Manual review.

Recommendations

Compute automatically the value of _performData in performUpkeep so it is always called with the necessary value for the vaults.