Lack of slippage forces operators to incur losses when _amount > withdrawableRewards
.
This function is called by vaults to withdraw operator rewards. The issue, however, is that it uses a hardcoded slippage, which forces operators to incur losses.
Step-by-step POC:
Operator reward is 100
.
Vault calls this to withdraw the operator rewards.
OperatorVCS.sol balance is 50
.
Rewards that get withdrawn to the operator is only 50
, skimming off 50%
from the operator.
Rewards would be skimmed off of operators since even something that's not accepted by them could end up being sent to them.
Manual review
Either allow the passing of a slippage value or update the accounting correctly, i.e., if _amount > withdrawableRewards
, send withdrawableRewards
but don't clear the state and later on when funds are available send the remaining, i.e., _amount - withdrawableRewards
.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.