Liquid Staking

Summary

The queueWithdrawal function in the WithdrawalPool contract contains a check to ensure that the withdrawal amount is not less than a specified minimum (minWithdrawalAmount). This check can cause a transaction to revert when the function is called from the PriorityPool contract, particularly when the amount to be withdrawn is a residue after processing queued tokens.

Vulnerability Details

https://github.com/Cyfrin/2024-09-stakelink/blob/main/contracts/core/priorityPool/WithdrawalPool.sol#L302

Steps to Reproduce:

1. A user initiates a withdrawal from the PriorityPool contract.

2. The PriorityPool attempts to fulfill the withdrawal request using queued tokens.

3. If the requested withdrawal amount exceeds the available queued tokens, the remaining amount (residue) is passed to the queueWithdrawal function in the WithdrawalPool.

4. If this residue amount is less than minWithdrawalAmount, the transaction reverts due to the check in queueWithdrawal.

Impact

This issue can prevent users from successfully withdrawing their tokens if the residue amount is less than the minimum withdrawal threshold.It can be adjusted by reducing the withdrawal amount or filling the withdrawal request in batches . But It can lead to user frustration and potential loss of trust in the system's reliability.

Tools Used

Manual Review , Cursor .

Recommendations

It can be solved in multiple ways . One of them could be :
Handling the residue amount within the PriorityPool contract to ensure it meets the minimum requirement before calling queueWithdrawal.