Wrong parameters for withdrawing funds
Summary
Balance, which is principal deposit with rewards, is used for withdrawing, after rewards have been given.
Vulnerability Details
In LSTRewardsSplitterController::removeSplitter(), we give back the rewards using LSTRewardsSplitter::splitRewards() which distributes the rewards and the next step is to withdraw the principal deposit, but here comes the catch.
We try to withdraw the balance which is the principalDeposits +rewards which will cause a revert because we try to withdraw more funds than there are actually in the splitter.
Impact
We will never be able to remove a splitter if we have rewards > 0, which is more likely than not scenario
Tools Used
Manual Review
Recommendations
Try to withdraw the principal amount, not the balance itself.
Lead Judging Commences
In `removeSplitter` the `principalDeposits` should be used as an input for `withdraw` instead of balance after splitting the existing rewards.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.