Liquid Staking

Summary

In the function withdraw at line 225 of PriorityPool.sol, there are no checks to verify whether the amount a user requests to withdraw (_amountToWithdraw) exceeds the balance they actually have in the system. This means that a user could potentially withdraw more tokens than they have staked or are eligible for, leading to a financial loss for the contract.

Impact

Excessive Withdrawals: A user could attempt to withdraw more tokens than they are entitled to (i.e., more than they have staked or queued). This could result in:

• Depletion of funds from the contract, affecting the availability of funds for other users.

• Financial loss for the protocol if users manage to withdraw beyond their staked balance.

• System instability as excessive withdrawals could lead to liquidity issues and erode the security of the staking pool.

Recommendations

Add Balance Validation for Withdrawals: Implement a check to ensure that the _amountToWithdraw is less than or equal to theuser's available balance.\ This includes checking the staked balance, queued tokens, or any other criteria that determine the user's withdrawable amount.