Part 2

Summary

The credit capacity check in redeem() uses .lte() instead of .gte() which causes withdrawals to revert when there is sufficient credit capacity and succeed when there isn't enough.

Vulnerability Details

In redeem(), the credit capacity check uses .lte() to compare the credit capacity delta with locked credit capacity.

But in fact, it should revert when the credit capacity delta is greater than the locked credit capacity.

Impact

Withdrawals will incorrectly revert when there is sufficient locked credit capacity and succeed when there isn't enough credit capacity to facilitate the withdrawal.

Recommendations

Change the comparison operator from .lte() to .gte() to properly validate that there is enough locked credit capacity for the withdrawal.