Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Lido Fixed Income>Threat Model>finalizeVaultOngoingVariableWithdrawals
GeneralOverview
Findings
Critical (2)
High (3)
Medium (2)
Low (5)
Informational (2)
DiscussionConsider transferring stETH instead of ETHConfusing math in finalizeVaultEndedWithdrawalsPremium claim requirement ensures safety tooComment implies more centralization than existsUse batch withdrawals for gas savingsUnused event `VaultCodeSet`
Threat ModelWhat are threat models?
LidoVault.solclaimFixedPremiumdepositfinalizeVaultEndedWithdrawalsfinalizeVaultNotStartedFixedWithdrawalsfinalizeVaultOngoingFixedWithdrawalsfinalizeVaultOngoingVariableWithdrawalsgetFixedOngoingWithdrawalRequestIdsgetFixedOngoingWithdrawalRequestTimestampinitializeisEndedisStartedmaxStETHWithdrawalAmountminStETHWithdrawalAmountstakingBalancewithdraw
VaultFactory.sol
Audit ResultsSummary

Function: finalizeVaultOngoingVariableWithdrawals()

This function is to finalize the variable withdrawal with requestIds.

Function call analysis

  • this.claimWithdrawals(msg.sender, requestIds) -> this._claimWithdrawals(user, requestIds) -> LidoVault.lidoWithdrawalQueue.claimWithdrawal(requestIds[i])

    • What is controllable? None.

    • If the return value is controllable, how is it used and how can it go wrong? None.

    • What happens if it reverts, reenters or does other unusual control flow? N/A.

  • this.applyProtocolFee(amountWithdrawn) -> Math.mulDiv(stakingEarnings, this.protocolFeeBps, 10000)

    • What is controllable? None.

    • If the return value is controllable, how is it used and how can it go wrong? None.

    • What happens if it reverts, reenters or does other unusual control flow? N/A.

  • this.calculateVariableFeeEarningsShare() -> this.calculateVariableWithdrawState(this.feeEarnings + this.withdrawnFeeEarnings, this.variableToWithdrawnFees[msg.sender]) -> Math.mulDiv(bearerBalance, totalEarnings, this.variableSideCapacity)

    • What is controllable? None.

    • If the return value is controllable, how is it used and how can it go wrong? None.

    • What happens if it reverts, reenters or does other unusual control flow? N/A.

Zellic © 2024Back to top ↑